a202bdd9c880cbaa457024a1362a6488_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a202bdd9c880cbaa457024a1362a6488_JaffaCakes118
Size

4.5MB
MD5

a202bdd9c880cbaa457024a1362a6488
SHA1

6ae331e9a6994c4ac5f86f2aa392f531d5730d2d
SHA256

5ae3ae407163f01abe5261370f7d0b753a17581c15347b7acfb27b38a5b82317
SHA512

5b57982da3d4b2cbe34bf1a3e3dca78ca7013b3e6da48b9ed101eb8fdbc3a8088e4198c0da55091bf45c6987d1c72dd5e765b55e7054a7eb68876572604b9015
SSDEEP

98304:gPU0RODKcNmyBoKojzJMvLiz+nImcM6SnIuCp8RMkdOcJCl:g5ROP3o+mz+nImcDuA8RMkOV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a202bdd9c880cbaa457024a1362a6488_JaffaCakes118

Files

a202bdd9c880cbaa457024a1362a6488_JaffaCakes118
.exe windows:4 windows x86 arch:x86

363d35535eca8b2e57b07ad1f7624def

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetKeyboardType
CreateWindowExA
DdeCmpStringHandles
ExitWindowsEx

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
DeleteCriticalSection
TlsSetValue
lstrcpyA
Sleep

advapi32

RegQueryValueExA
RegSetValueExA

oleaut32

SysFreeString
SafeArrayPtrOfIndex
GetErrorInfo

mpr

WNetGetConnectionA

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

CreateStreamOnHGlobal

comctl32

ImageList_SetIconSize

Sections

.text
Size: 45KB - Virtual size: 21.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE