be7954559199d33cef0a2496160f1764_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

be7954559199d33cef0a2496160f1764_JaffaCakes118
Size

20KB
MD5

be7954559199d33cef0a2496160f1764
SHA1

f86e5c119ab9d1596644cb932ce724d3466bdfd0
SHA256

5787c5c5eb32508cbd46d17a217d17e46219c4682a40bea44252bf08ea313b20
SHA512

e1cda0f6324f2596c8d9f5718e09c23335812a715fc4b26c64c2776dcc7f2fc3fa8af1cf472f205c89d3fc34bf668643e97c31570fa6793989e1d3db509feb5a
SSDEEP

384:H5FM3e2ghQwQ0xc/YfnThsv1Ysj06qKKBet/Pkihd/ivVQawxYM52LE:Ls3CzpcQThstYsj0b2Rr5OE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
be7954559199d33cef0a2496160f1764_JaffaCakes118

Files

be7954559199d33cef0a2496160f1764_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1359a50ea21b312f0f42427815c5f387

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetKeyboardType
MessageBoxA

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
DeleteCriticalSection
TlsSetValue
WriteFile

advapi32

RegQueryValueExA

oleaut32

SysFreeString

urlmon

URLDownloadToFileA

Sections

.text
Size: 20KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE