f9c582b4bc36d253927ece584496638b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f9c582b4bc36d253927ece584496638b_JaffaCakes118
Size

545KB
MD5

f9c582b4bc36d253927ece584496638b
SHA1

29629894bffdfb6798b9d24e36356b348f277a9c
SHA256

e061da491e39e8e94ac79b8adbbf163e711983918ef5d2d3c7aaf194c71ebea0
SHA512

7fff400d095e1df769995f4cc88a6fba4c1b63df7f9988fa59575bc8cc1aa4851dec09198e854a59c39e2c700aa5214e3b0c0fde7206a023f3484a25e342bba4
SSDEEP

12288:3bHOlxmruzHbtK3SBqaDvvRafLMxa6aMXG4I1qConvoN:3jOPmruLPZiMnG4PCsvoN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f9c582b4bc36d253927ece584496638b_JaffaCakes118

Files

f9c582b4bc36d253927ece584496638b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4cae0135abcaf3d0a58730f5b76f9e1b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

UnrealizeObject

comctl32

ImageList_SetIconSize

shell32

ShellExecuteA

comdlg32

GetOpenFileNameA

Sections

CODE
Size: 534KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE