ac0cf40eab009954498a92530f5cc170_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ac0cf40eab009954498a92530f5cc170_JaffaCakes118
Size

1.7MB
MD5

ac0cf40eab009954498a92530f5cc170
SHA1

26e0d0252cfda45742132c9c159e5b5d3c37ccf6
SHA256

95f4a9358cbb4b94c7da10737e1ebb20c794496ebea1c7ba31decfb3a543d98a
SHA512

540e386ef57cff1b95b962cf71a118e86eb6dc3d1ab6576c1ea40caba722079f886305c939035348fba90a371a39bebdf0964885f2c8b1a1d4fc798d04628ba2
SSDEEP

49152:ekswKjQQmRrmhm9tR0ptrIbTj8mfj3jgc:e3wKMQWrGm9t4Ibf5f7l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ac0cf40eab009954498a92530f5cc170_JaffaCakes118

Files

ac0cf40eab009954498a92530f5cc170_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c211b94bb85d9592360c13e45940695d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetKeyboardType
CreateWindowExA
DdeCmpStringHandles

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
GetACP
TlsSetValue
lstrcpyA
Sleep

oleaut32

SysFreeString
GetErrorInfo
SafeArrayPtrOfIndex

advapi32

RegQueryValueExA
RegSetValueExA

gdi32

UnrealizeObject

version

VerQueryValueA

ole32

CreateStreamOnHGlobal

comctl32

_TrackMouseEvent

urlmon

URLDownloadToFileA

wininet

InternetGetConnectedState
InternetCrackUrlW

wsock32

WSACleanup

Sections

.text
Size: 25KB - Virtual size: 4.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE