d99637fda6490313a0bad8819a049848_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d99637fda6490313a0bad8819a049848_JaffaCakes118
Size

643KB
MD5

d99637fda6490313a0bad8819a049848
SHA1

a4b35a7e9c256bd347268bf3cdf7bcb9a93dd54f
SHA256

b168dfa8372001fc9b411980e2ffd7ec00150106c16c22216f7a6f8d3159d411
SHA512

83b61199279b93cd3346737de9cdf9f4035ca5d94a015e620bd99453525ce4e0bef38bc946da553a8b6c8c16b1c9755401f82dbd451e73435224ff6fdf368b9d
SSDEEP

12288:tkpB13ylPrqpEaVa79La9MvbD8bEDJWSQyF8k2djGsSmYn3/thaYCkIb+T3VW6kH:OpBwlPepEaO9L8QbD4cJ/QyFz2dImCFN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d99637fda6490313a0bad8819a049848_JaffaCakes118

Files

d99637fda6490313a0bad8819a049848_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0f68c6cc0b146dd9b3164bf988ef61b6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

CreateStreamOnHGlobal

comctl32

ImageList_SetIconSize

winmm

timeGetTime

Sections

CODE
Size: 630KB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE