c0e758f3c9520a8aec75b45817835bb7_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c0e758f3c9520a8aec75b45817835bb7_JaffaCakes118
Size

216KB
MD5

c0e758f3c9520a8aec75b45817835bb7
SHA1

734c4a54af191297ce59d3e2f65faf584a5a9a4c
SHA256

9763e67abeeb8545f099b92957662688c411fb42f1a702ef93530ec940c4a566
SHA512

8cdff3a85350a19152e41b808214aa6afbb1ae915ede149ce8ebcb7ec63214d49a1fe12c28680a6169ef8d6b29674e02b56ceba2f2e3898775698681fd58a90b
SSDEEP

6144:mP4WbIxYPOJFTuhFNH12ApD0kMg00riuygL3RSk:BCAYPsFShLD0DIp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c0e758f3c9520a8aec75b45817835bb7_JaffaCakes118

Files

c0e758f3c9520a8aec75b45817835bb7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

397865c786c4c8766a601cbd893174f5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegQueryValueExA

user32

GetKeyboardType

gdi32

UnrealizeObject

version

VerQueryValueA

comctl32

_TrackMouseEvent

Sections

.text
Size: 183KB - Virtual size: 584KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE