efcd317775d1beaf3df43544adbcecf3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

efcd317775d1beaf3df43544adbcecf3_JaffaCakes118
Size

43KB
MD5

efcd317775d1beaf3df43544adbcecf3
SHA1

a865d8d6457a69ae7fc7459ff263fe11ad3b0969
SHA256

80609f550d30560922fc9a15da00f865d2c3c1d4ba0abbf8b2cb1bb256d4d4cb
SHA512

0012e73723cda4a551a2a957aba79ca89353e5b566cf6dd4c80f1a29e73bcd6abe9a3da9c6ece6c27a6419126da57b33a078dbb48e3b25f1afb3f6985d61b082
SSDEEP

768:KV16fVc5TemT35/UUTWZW6o7g0yk4bN1nK6luyqI0vlJOG/sbn9DoM:f2TemT35sWE08bjnK64rOxj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
efcd317775d1beaf3df43544adbcecf3_JaffaCakes118

Files

efcd317775d1beaf3df43544adbcecf3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

29d4d9a4e535bff721362e89820bef9e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegQueryValueExA

user32

GetKeyboardType

shell32

SHGetSpecialFolderPathA

Sections

.text
Size: 37KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE