c0b22f609f9eab30548251ec0c14e655_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c0b22f609f9eab30548251ec0c14e655_JaffaCakes118
Size

67KB
MD5

c0b22f609f9eab30548251ec0c14e655
SHA1

05e74f15027a0bc5424f3269ffb7b8ce498fa969
SHA256

2cb904366a3608b5e792151c151f9a2d0aaca0d7f4659a57969b6bba9d611521
SHA512

965c2d5d8900c1963afa6346509f1637403f5750a222dfbc88d803b34a28e138014ce61473b81d5584b5092ec294b234c31802f4b4b1f519e8963a539bd2ceb1
SSDEEP

1536:fFuxhhvxWe9NSH0mvs1ZP7A/CZkhnrCFOdx:fQxhhJWlUmvs1ZjA/inW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c0b22f609f9eab30548251ec0c14e655_JaffaCakes118

Files

c0b22f609f9eab30548251ec0c14e655_JaffaCakes118
.exe windows:4 windows x86 arch:x86

29d4d9a4e535bff721362e89820bef9e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegQueryValueExA

user32

GetKeyboardType

shell32

SHGetSpecialFolderPathA

Sections

.text
Size: 55KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE