fd36c816e5f48007783213f780b67463_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fd36c816e5f48007783213f780b67463_JaffaCakes118
Size

1.2MB
MD5

fd36c816e5f48007783213f780b67463
SHA1

143decfb4dcb53c095f8a5b58ddc581835732775
SHA256

3208abae72ccefb793f6bbe40a24ce4d80e3b5d296f48518785ea4e3e55f5a82
SHA512

d70bee567067c91484b4acd7e6eb0b85d8c24298f0b460d52844846beb30475278482eaeff68a66329450d253d6299830747569b25b28ab0a27e489eeefb3f30
SSDEEP

24576:rdDTtFlbOH070pMtk1j7YOc3nxN+32Pbto5qHlcBpFi9ZbLn:rdDTtVQpMtkhEO0xN+vml0FKJLn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fd36c816e5f48007783213f780b67463_JaffaCakes118

Files

fd36c816e5f48007783213f780b67463_JaffaCakes118
.exe windows:4 windows x86 arch:x86

34481a5ad898b066b87deda94a9e7dd6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetKeyboardType
CreateWindowExA
DdeCmpStringHandles

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
DeleteCriticalSection
TlsSetValue
lstrcpyA
Sleep

advapi32

RegQueryValueExA
RegQueryValueExA

oleaut32

SysFreeString
SafeArrayPtrOfIndex
GetErrorInfo

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

CoUninitialize

comctl32

ImageList_SetIconSize

Sections

.text
Size: 20KB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE