d13d29bffc8927cdea88dc0302a84db8_JaffaCakes118 | Triage

Sharing

General

Target

d13d29bffc8927cdea88dc0302a84db8_JaffaCakes118
Size

25KB
MD5

d13d29bffc8927cdea88dc0302a84db8
SHA1

1e5a1b75df7d8979daa720eecfc5038f1508c84c
SHA256

1c0f7bbb44f06ea1a1258b49dbec2548f1f4533fa0166e4e334fa364846b2ef2
SHA512

7a93fa517e86251f2c5ab774045ab5caeabac062a1d066b5d02726440ef312866efb6fba5ec5d276363983a275e7017728cf49c713c46f52aeacc4ea9cf071c3
SSDEEP

768:YqbKI+C2pbyw15X/WllPlqZrpvUZYzciu2:TKI+C2pWw1kzNq7M8ciu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d13d29bffc8927cdea88dc0302a84db8_JaffaCakes118

Files

d13d29bffc8927cdea88dc0302a84db8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6aca19fcc834d558ccd0d4e1d52008a7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

msvcrt

strchr

user32

GetCursorPos

shlwapi

SHDeleteValueA

wininet

InternetSetOptionA

shell32

SHGetSpecialFolderPathA

advapi32

RegSetValueExA

ole32

CLSIDFromProgID

oleaut32

SysStringLen

msvcp60

?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ

Sections

.text
Size: 19KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE