d2d357777a1e36aa88922fd994646d56_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d2d357777a1e36aa88922fd994646d56_JaffaCakes118
Size

238KB
MD5

d2d357777a1e36aa88922fd994646d56
SHA1

f4eed1ed57ad104bf0e4805a4b611dcdb9eac141
SHA256

507a1e8ec8d52b63183b0a25575486e252b0d6d0701863295b3a6c509f597fa2
SHA512

981160e662c944c3b323ac03e8dd2c3b349492fabaddd2b6688be296fb24065494f34bbb30cc231c250e2e5f0fce2038094c436f987294c6d19748acae487796
SSDEEP

6144:oOE4jvEUWDWKVkZtiIu+gNYLahuOkOaB4YXdFl/:C4gUltiIp9LawGalXd/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d2d357777a1e36aa88922fd994646d56_JaffaCakes118

Files

d2d357777a1e36aa88922fd994646d56_JaffaCakes118
.exe windows:4 windows x86 arch:x86

498f1c3b1cfdd1f6431d4d43ce7429d6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetKeyboardType
PeekMessageA

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
DeleteCriticalSection
TlsSetValue
WriteFile
Sleep

advapi32

RegQueryValueExA

oleaut32

SysFreeString
SafeArrayPtrOfIndex

Sections

.text
Size: 20KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE