aa49164970e83327cc5290364092e132_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

aa49164970e83327cc5290364092e132_JaffaCakes118
Size

491KB
MD5

aa49164970e83327cc5290364092e132
SHA1

8ef65e6193ca7115c48706d8fe41e7f39cfdd1ff
SHA256

942a8e74bb0611b88048a6b00dca417b0637f7d41da81e214ecc22016dd904ae
SHA512

f81c596caaa0c9fc6acdf72b5cfcad105253ddd81538cd9bc544af6f5b3e1e0645af511cc835cf59b8b7e8379e2340242a1336ec1a3908e3137d5e54016876a0
SSDEEP

12288:iL9XWDBBfxH0Y0BgcaoHahFp/6lbKBhWlFmT21uy:iL4jx7GgcEhLWyhDT21r

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa49164970e83327cc5290364092e132_JaffaCakes118

Files

aa49164970e83327cc5290364092e132_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9b1367cd8ec5bc368703bd039296e4ae

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetDC

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
LoadLibraryA

advapi32

RegCloseKey

comctl32

ImageList_Add

gdi32

SaveDC

ole32

CoInitialize

oleaut32

VariantCopy

shfolder

SHGetFolderPathA

version

VerQueryValueA

wininet

InternetOpenA

winmm

timeEndPeriod

Sections

.text
Size: 19KB - Virtual size: 484KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE