d358b72700c8b4d64536094fe7d5bd5b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d358b72700c8b4d64536094fe7d5bd5b_JaffaCakes118
Size

112KB
MD5

d358b72700c8b4d64536094fe7d5bd5b
SHA1

a29167d773c9700676865a06346cd4bbe9ff7777
SHA256

49bc82ae35a7a68c0291873d9d812c020ac3c904d45f7486073ce473e9493f7e
SHA512

ac608fed4084ce0278deb2a1fa20b85c43c92c3c500f10ad9183cd7a528f744ff2b65cbd7777c735a288b0d4376f82c559c58b408e0af2f1e9f067983c63113b
SSDEEP

3072:WT6EsVTUarLiWdwg2frkiaD8hMGOzGLVoy7XnpARUcJg:WT6B2Tf9aD8UzGLCy+bi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d358b72700c8b4d64536094fe7d5bd5b_JaffaCakes118

Files

d358b72700c8b4d64536094fe7d5bd5b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

816bed4b39f6ae6e55b9ac040c389014

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetKeyboardType

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
DeleteCriticalSection
TlsSetValue
Sleep

advapi32

RegQueryValueExA

shell32

ShellExecuteA

Sections

.text
Size: 19KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE