a79ba3fcbcbbcc9d92c552b38d8dceb4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a79ba3fcbcbbcc9d92c552b38d8dceb4_JaffaCakes118
Size

84KB
MD5

a79ba3fcbcbbcc9d92c552b38d8dceb4
SHA1

5fe80c586449825c6daaf195fcad10c8243f7bf1
SHA256

d06c904931d901a1c384e0986731b17959ccf3706e35482ae3c8f0932afbd5d5
SHA512

822f3eff665bdfdd95c2b74cc23b414c73589d353f4e764ece9d27d52b4515f4f128cb642e08c06b995cbc61571606c86c3af6f8efad860ed926cf4388f05277
SSDEEP

1536:dt6AOz2KG/L5Q5onYVYQ4tlB0DCY81MpOxvYahlCqmqJ9iktXUrBPguVj5fYvvpg:PsaQ5onpbtlxGpOvCujirvmFVW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a79ba3fcbcbbcc9d92c552b38d8dceb4_JaffaCakes118

Files

a79ba3fcbcbbcc9d92c552b38d8dceb4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

345bad7f35b55fa170875044f60ecb55

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegQueryValueExA

user32

GetKeyboardType

ole32

CreateBindCtx

urlmon

MkParseDisplayNameEx

shell32

SHGetSpecialFolderPathA

Sections

.text
Size: 70KB - Virtual size: 228KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE