f516d93975661d14d4c042a4543d8d77_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f516d93975661d14d4c042a4543d8d77_JaffaCakes118
Size

256KB
MD5

f516d93975661d14d4c042a4543d8d77
SHA1

f924f98684a225baac28cafba95ede49b0d26e4c
SHA256

f170169aa8e8435117217a5c3fadbc4f9c36619553b44a55772eef5296e588ff
SHA512

311acfcd1e18f1e1fe522c66240cf80cc9e240ea952743a3514318aa072a5faf38acadb7b24d3dce912c7bab7212721b6502de9773e843c92e841fc961e9dce2
SSDEEP

3072:309lgVW83HOcCfWbbyRAWQfA3GNjS1FMnK5cq2uk9:30ftknZqTT6/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f516d93975661d14d4c042a4543d8d77_JaffaCakes118

Files

f516d93975661d14d4c042a4543d8d77_JaffaCakes118
.exe windows:4 windows x86 arch:x86

788e808a9206f7183ae423f071fa801a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetKeyboardType
CreateWindowExA

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
DeleteCriticalSection
TlsSetValue
lstrcpyA
Sleep

advapi32

RegQueryValueExA
RegQueryValueExA

oleaut32

SysFreeString
SafeArrayPtrOfIndex

version

VerQueryValueA

gdi32

UnrealizeObject

comctl32

ImageList_SetIconSize

shell32

ShellExecuteA

Sections

.text
Size: 181KB - Virtual size: 664KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE