be1696edbc72699daedc85e9b79d91be_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

be1696edbc72699daedc85e9b79d91be_JaffaCakes118
Size

28KB
MD5

be1696edbc72699daedc85e9b79d91be
SHA1

489319728a946eef3337c7c2c1f7dc48c963856f
SHA256

dd4a1f89641d12895cccf03236f481f94a4bfea9a1c00a7bb04f686496b563d8
SHA512

106f40b48ea894b619c49cec3835dde81d5816a80b3b6185aa9c9dbaec18ecbabe68a9f114c3f9ada64ec1ee0b2245a77cd694198833aec286443e2941e18edd
SSDEEP

384:OWVONPopN93OpZAdRywjnxGjHRVR5LsJSwELcaXs62TDD2Tg36R8vqReuSSQNTC3:UvwjxGbL4G1Xs62nqE6Cq/SDTCtx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
be1696edbc72699daedc85e9b79d91be_JaffaCakes118

Files

be1696edbc72699daedc85e9b79d91be_JaffaCakes118
.exe windows:4 windows x86 arch:x86

18ff2195c7aca668aaf97428a784abc8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

VirtualProtect
GetModuleHandleA
GetProcAddress

user32

CharNextA

advapi32

RegCloseKey

oleaut32

SysFreeString

gdi32

GetStockObject

urlmon

URLDownloadToFileA

Sections

.text
Size: 27KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

520xh
Size: 52B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE