9637f9576dd8461d919f853d974987a5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9637f9576dd8461d919f853d974987a5_JaffaCakes118
Size

1.6MB
MD5

9637f9576dd8461d919f853d974987a5
SHA1

ed2b08a062572e185f53eec944a6812b29467b3f
SHA256

81abe4c78e75119f6a0afce81cf799d9a9ff0a8bb91555b9b30ca3c4442f16c4
SHA512

b57a8d3b8c2db8aea76cb5818cdd35c1e35c20b291ce68ad06c31aed56afc0d69ea120ccbb9417e87d080dd86d1036ba6469ecc366de5017519d62c494785410
SSDEEP

49152:ONq3MGaj/iXhi05xFC9V9k9VryhHP5x7tUp:OiHbd8/aVY5w

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9637f9576dd8461d919f853d974987a5_JaffaCakes118

Files

9637f9576dd8461d919f853d974987a5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ce74b321df2b731a5b4e6a58b96fe07a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

mpr

WNetGetConnectionA

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

CreateStreamOnHGlobal

comctl32

ImageList_SetIconSize

shell32

ShellExecuteExA

wininet

HttpSendRequestExA

comdlg32

GetOpenFileNameA

wsock32

WSACleanup

Sections

CODE
Size: 1.5MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE