d56c94d609c879d65fa72dc11c27969a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d56c94d609c879d65fa72dc11c27969a_JaffaCakes118
Size

26KB
MD5

d56c94d609c879d65fa72dc11c27969a
SHA1

adf617b8ba2c435ef0d2ac26818c77d5b2d5ba8a
SHA256

0b5211f6062cc6b82e0d8a5c5f8daa9524486f356ef078c3e3f6eb746b0a7aad
SHA512

32950629fb8b2f86d6af366e4a46036a9c1983a911b708a56649cd85bde2e6e3280d34940c8a2599cd0469d48104729d30fec808f9821425f7ff188310c73b11
SSDEEP

768:tsvkaqHlaE1+iDIzTnd+AUU57ijpae3przw:tmcIidwTndUGiVH3u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d56c94d609c879d65fa72dc11c27969a_JaffaCakes118

Files

d56c94d609c879d65fa72dc11c27969a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1359a50ea21b312f0f42427815c5f387

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetKeyboardType
MessageBoxA

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
DeleteCriticalSection
TlsSetValue
WriteFile

advapi32

RegQueryValueExA

oleaut32

SysFreeString

urlmon

URLDownloadToFileA

Sections

.text
Size: 21KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE