ac0588ed49779c96b91cf83efef878ef_JaffaCakes118 | Triage

Sharing

General

Target

ac0588ed49779c96b91cf83efef878ef_JaffaCakes118
Size

1010KB
MD5

ac0588ed49779c96b91cf83efef878ef
SHA1

e0549cc722e2c8dfd07cc8d4ae7b028dc9652ec0
SHA256

8697a96af1dda9bb9f808054514ed735b87fed0d181be0dda9cdcb2032c2a26f
SHA512

427a012f7011bdbf2a36c2f1181e32351aa2a7bbb1a8919ea41f0ef20e2828ae83c02f40028cbd76dbb32de7427e0432611a0948c55dfe995b1c77b3a23c2dc2
SSDEEP

24576:n/Rr6n/IaTUKuTkxA9bBMwGxX99zZlzg6J4+pMGAV3sU:JCxA1GwA9zZZRiiMGAVcU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ac0588ed49779c96b91cf83efef878ef_JaffaCakes118

Files

ac0588ed49779c96b91cf83efef878ef_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5b5b074fe5ee681afe9bbe997292bcaa

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

advapi32

RegCloseKey

user32

GetCursorPos

gdi32

SelectObject

shell32

DoEnvironmentSubstW

ole32

CoRegisterMessageFilter

ws2_32

WSCUnInstallNameSpace

wininet

InternetCloseHandle

msimg32

GradientFill

comctl32

ImageList_ReplaceIcon

shlwapi

SHDeleteEmptyKeyW

oleaut32

VariantChangeType

wsock32

accept

iphlpapi

IpRenewAddress

winspool.drv

ClosePrinter

Sections

.text
Size: 971KB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 38KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE