ac782a0bc07fc653b10f6506a584b494_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ac782a0bc07fc653b10f6506a584b494_JaffaCakes118
Size

185KB
MD5

ac782a0bc07fc653b10f6506a584b494
SHA1

6f3bdeab811e24db0bc4af4f266d750a453ac484
SHA256

bb627abeee020fe720b1b6503ed4d13216a01b683027c444727aed6177f355bf
SHA512

48d3407d11b818a9076e3603cbf1c0bf62f0e839c6b601f1e2b31ab6ee8d3f64e6a96f22998808901d94a3905f803ba211d50697a22dc56e3a9c05d8bf8ae28f
SSDEEP

3072:9B3x47jBE7caiCErpkaX9gnE5lT9RzqmQd//j4C1tp52c2x3:7W7jBE7/4rpFRfbqmQJLbpod

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ac782a0bc07fc653b10f6506a584b494_JaffaCakes118

Files

ac782a0bc07fc653b10f6506a584b494_JaffaCakes118
.exe windows:4 windows x86 arch:x86

12d8c01c13b0cd96bd5d5f788f7dd76c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegQueryValueExA

user32

GetKeyboardType

gdi32

UnrealizeObject

version

VerQueryValueA

wininet

FindNextUrlCacheEntryA

ole32

CreateStreamOnHGlobal

shell32

SHGetSpecialFolderPathA

comctl32

_TrackMouseEvent

Sections

.text
Size: 178KB - Virtual size: 496KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE