befa2bad1f8e7e4724a5419818cfc694_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

befa2bad1f8e7e4724a5419818cfc694_JaffaCakes118
Size

2.2MB
MD5

befa2bad1f8e7e4724a5419818cfc694
SHA1

636adec08e2a661cd91a659d6b997ca12272fd5c
SHA256

0684079da3dc36229e6da0343265f20ff2abb5f7aa3b29f4abb18ddd4e5311d6
SHA512

635a15690c7999e31fba97df72ed2aa4f36f92ccb11952f9d05b75b28977741230279b67a08873cd3a1054e9f2c12143cc98f0bb047390e0eb0651d8a81731cc
SSDEEP

49152:cipeKQBHL051IRqeGaYItPQ7V2pKv1FDttGWzyT/25WFoWGF:/pnmHLq1IDGaY04pTvDda/ZVI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
befa2bad1f8e7e4724a5419818cfc694_JaffaCakes118

Files

befa2bad1f8e7e4724a5419818cfc694_JaffaCakes118
.exe windows:4 windows x86 arch:x86

72ee0489bc5f77225eb835bc6f612eae

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

IsEqualGUID

comctl32

ImageList_SetIconSize

winspool.drv

OpenPrinterA

shell32

ShellExecuteExA

wininet

InternetSetOptionA

urlmon

CoInternetCreateZoneManager

comdlg32

PrintDlgA

winmm

timeGetTime

Sections

CODE
Size: 732KB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE