d5197bdbf56698d5212c6c57cde6750d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d5197bdbf56698d5212c6c57cde6750d_JaffaCakes118
Size

1.9MB
MD5

d5197bdbf56698d5212c6c57cde6750d
SHA1

2b6a50dcf179b4aa892952c1fd6593189c44f3e7
SHA256

7109488ced5f281bca157c4b27a3d96fd5412f5b23e3cf492a98d6d678d08d50
SHA512

a68ca39054e1e8ff9f6ba5593784898b9faa53c62a63d7e3a1ecb1a1728c83a87b2b577b85beaf3269a2329de85013b044f0cab47efe3e85ec6398fb3dff4f3f
SSDEEP

49152:tpxYJarpADv+MzD4OS/kTdiJR4js64HrvOV2oFiyvjox:jrS6MzEmdiT4jZ4LvOV2Ciysx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d5197bdbf56698d5212c6c57cde6750d_JaffaCakes118

Files

d5197bdbf56698d5212c6c57cde6750d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b220332c714857c7149c2b3a8f05871c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetKeyboardType
CreateWindowExA
DdeCmpStringHandles

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
DeleteCriticalSection
TlsSetValue
lstrcpyA
Sleep

advapi32

RegQueryValueExA
ReportEventA
StartServiceCtrlDispatcherA

oleaut32

SysFreeString
SafeArrayPtrOfIndex
GetErrorInfo

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

CreateStreamOnHGlobal

comctl32

ImageList_SetIconSize

Sections

.text
Size: 25KB - Virtual size: 26.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE