ab48b42e8d4336a8778577c90079d966_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ab48b42e8d4336a8778577c90079d966_JaffaCakes118
Size

159KB
MD5

ab48b42e8d4336a8778577c90079d966
SHA1

af3ae993af8da0d88e7be6e922183dd6caa1f106
SHA256

59a7b269f82a981103681109d6004a0836fde8210ca52e8245eb4356dfe805c9
SHA512

b7419acabc59a78d9f0fd0e4e930ff76deb3f37075b339caffdf166a404c8d06fae7140ee2c91c0946e74d5c311c1668b3bc1fbdbe423b5c376d5850e4020bbb
SSDEEP

3072:Tj+vIhE7t7Ttuv7QhlwV1HQ7CLdg5q8FC1/Ri87ZMUd4SBAh/Lj+WPusu7:TjM7TtuDUlaZQui5qMC1/RY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ab48b42e8d4336a8778577c90079d966_JaffaCakes118

Files

ab48b42e8d4336a8778577c90079d966_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ae0a5112fe1176f4e5f6e1bc95e4c209

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA

kernel32

FreeLibrary
lstrcatA
GetModuleFileNameA
ExitProcess
LoadLibraryA
GetProcAddress
lstrlenA

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 404B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 151KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ