a9a5cc297634f83dfa245015f632d923_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a9a5cc297634f83dfa245015f632d923_JaffaCakes118
Size

113KB
MD5

a9a5cc297634f83dfa245015f632d923
SHA1

92fb28c77ddbcb74044a880ff9b5f24b6e29215d
SHA256

de27315b025ee04940e3f322d9ff94cd3d04b3e61f9df03832783deee50b38b6
SHA512

63eaea060651ddab22c318b5eba33f1cdd70bce40bbe2de21c1aedf65a3740eb955123978ed5ac97047e9c91c65e31311ec461a942602c9be426afeb361fb44f
SSDEEP

3072:LTs5x4xltG2ZMfphtK8mviJIJ0sYSsMch:LTsAfGeI+izsbsMch

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a9a5cc297634f83dfa245015f632d923_JaffaCakes118

Files

a9a5cc297634f83dfa245015f632d923_JaffaCakes118
.exe windows:4 windows x86 arch:x86

de6fdcdc7f4ad649a7529bf91b3c3b02

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

ws2_32

WSCInstallProvider

Sections

CODE
Size: 107KB - Virtual size: 320KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE