b4d65ef3f5fba99ca2d1889ade6d25ab_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b4d65ef3f5fba99ca2d1889ade6d25ab_JaffaCakes118
Size

31KB
MD5

b4d65ef3f5fba99ca2d1889ade6d25ab
SHA1

81df261670f48dbc5a8d748f53dde0e9bf2af6dc
SHA256

f6025159943329da5c0ee9b858a61079327aa08df11daa3add7ce0dd0a68cca7
SHA512

0b9e4bf68bcebad6fe46b6277d78210ca3fa05edc7a770c5a3368d6fd1346f0fe50d21db09bcd1a5737e781ab74fb3bf796334724a5693f9f814756588a20ab6
SSDEEP

768:xSyM3ZO51CUELMdLLov2b7XBzcpu54Ag5NHp7prpqd2mleST:xSRiYUEAJLoub/g5NJ7rqljT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b4d65ef3f5fba99ca2d1889ade6d25ab_JaffaCakes118

Files

b4d65ef3f5fba99ca2d1889ade6d25ab_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8ba12bdfa74a27e146598d74691c199d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetKeyboardType
MessageBoxA

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
DeleteCriticalSection
TlsSetValue
WriteFile
Sleep

advapi32

RegQueryValueExA

oleaut32

SysFreeString
SafeArrayPtrOfIndex

urlmon

URLDownloadToFileA

Sections

.text
Size: 25KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE