bda176672ee0a00f78a15891663fbd97_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bda176672ee0a00f78a15891663fbd97_JaffaCakes118
Size

319KB
MD5

bda176672ee0a00f78a15891663fbd97
SHA1

6da7390b803e57f78d12a3d9ba8fe3f0475755cc
SHA256

18a1ab37e20f09f84f697fe72510af56f1c0fd839c5977524226e2e858bb654f
SHA512

c406a6942f23c595a93cf7820954c4f39b48279da480e972a150fa2387d7b26de9a61f4b7d7208831edc66c7c0b24954dc3f2f09971145b80b8a6db27b788a44
SSDEEP

3072:u2qkDquknQ+bxxPd7zAIRfcxkJFRanLhlGiN9rTL9Okn/pcg53vs/Inb:u2k7jdWxkJULLL9V/3Rn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bda176672ee0a00f78a15891663fbd97_JaffaCakes118

Files

bda176672ee0a00f78a15891663fbd97_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f0c81b6f8530eba9d7b8894954822d1c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegQueryValueExA

user32

GetKeyboardType

gdi32

UnrealizeObject

version

VerQueryValueA

comctl32

_TrackMouseEvent

shell32

Shell_NotifyIconA

Sections

.text
Size: 149KB - Virtual size: 440KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE