fb6365b5b78a0d21c6e320efef2916a5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fb6365b5b78a0d21c6e320efef2916a5_JaffaCakes118
Size

51KB
MD5

fb6365b5b78a0d21c6e320efef2916a5
SHA1

cecf7a975f535e92883914cb1a31f94358499db9
SHA256

c1c9e3ff6bf2995b89a455b51557f00243c39f4bc2591be3da9207039a6306e7
SHA512

36f764d100c2e6c6878f2cb7ec93d831f3f56df0660222b3993515003c43575a64b320a136f51a205e5a0479f65e00369872ba3b3948182fd86e8047edbc081e
SSDEEP

768:70ZFA2MZA2mXkAoL1LNRkULXY0ySEfWQF3KR7Lhsf5Xo2Y8pbLL8sCijnGb4l:INMZ8S9N9o09sBw71Uy2YebLL8sCof

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fb6365b5b78a0d21c6e320efef2916a5_JaffaCakes118

Files

fb6365b5b78a0d21c6e320efef2916a5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bd321b1e97ddda73ac525120a887a6ea

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

urlmon

URLDownloadToFileA

advapi32

RegCloseKey

shell32

ShellExecuteA

user32

CharNextA

oleaut32

SysFreeString

Sections

.text
Size: 42KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE