af4be5083cf749cd1a32d2a3ed7a7c04_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

af4be5083cf749cd1a32d2a3ed7a7c04_JaffaCakes118
Size

40KB
MD5

af4be5083cf749cd1a32d2a3ed7a7c04
SHA1

68357ffbe323470077d5faf2454b14108072728e
SHA256

afc71fe0c14072697110921d9d238dabef53ebe5ca9bd1fbc633c2344c42eb0f
SHA512

e926e7724d82dced0f0adc43bea4dd62779f4e4ea726f7fd975625570a6b4d9f533c95dbbbf4989999d183f6edf2c07515372248fd14af06c0e2dce0000670e1
SSDEEP

768:ymopm+yzsld9wU9pgfJGXMW9z5dskzp5f8SSJK6O3pBTk79aZeJl3zrzTGDpGW:yUFU9C08wdFvXv6O5B89AE3XzaDN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af4be5083cf749cd1a32d2a3ed7a7c04_JaffaCakes118

Files

af4be5083cf749cd1a32d2a3ed7a7c04_JaffaCakes118
.exe windows:4 windows x86 arch:x86

55c210bf339923d28d3f67304e5ff52c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetKeyboardType

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
DeleteCriticalSection
TlsSetValue
GetEnvironmentVariableA

advapi32

RegQueryValueExA

urlmon

URLDownloadToFileA

Sections

.text
Size: 20KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE