a5b9494b510e1347c1d40a805c3c30ec_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a5b9494b510e1347c1d40a805c3c30ec_JaffaCakes118
Size

240KB
MD5

a5b9494b510e1347c1d40a805c3c30ec
SHA1

ce98181764db3dd7c1ecb6ab5e7b270ce18c0d82
SHA256

f54705ffa8349d50ab563020a77d5e0cd5372efbeab75fb5e3f22a4ab5776a2a
SHA512

e45fdccec8fa7d444c59fe1d9891c65b4973918d170733f887f18e80dfb4bf7e7d87f21e6f768bf61af6738ee94665ca9aa1780701ee7ded1f25a39407a31dfb
SSDEEP

6144:CQGJLl8K4b9E+B8U8AuT5PJ9vWqINCx4rps15bAYjm76Qu:DjBHtkeO/5bAT76Qu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a5b9494b510e1347c1d40a805c3c30ec_JaffaCakes118

Files

a5b9494b510e1347c1d40a805c3c30ec_JaffaCakes118
.exe windows:4 windows x86 arch:x86

498f1c3b1cfdd1f6431d4d43ce7429d6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetKeyboardType
PeekMessageA

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
DeleteCriticalSection
TlsSetValue
WriteFile
Sleep

advapi32

RegQueryValueExA

oleaut32

SysFreeString
SafeArrayPtrOfIndex

Sections

.text
Size: 20KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE