ff62dbd13e927f38b7e428d182341eff_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ff62dbd13e927f38b7e428d182341eff_JaffaCakes118
Size

311KB
MD5

ff62dbd13e927f38b7e428d182341eff
SHA1

3ddd456fb255278563acc73237d333d40b0e9c87
SHA256

b6473f6ae39c1de5670c79829bd19ffc8b74f2891d703c01bcc762fba4c235f0
SHA512

83b68a351a7f6a7112b64840581b02312b01a4b8c139f9ea3d3cdabf0e5c0199fed6259eb94bf21015b75997b46bdf2be6262f988ab9aa73d7b13a3868753ef1
SSDEEP

6144:6LZQZzn0kvy+87B81MB7q1HIZM3W/kwDpIQ7z8oMVQjQLW1xAIH9R0cacwLrbNqs:BhnHvy++KEGHZsp57wkEiAQRGcubNqs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff62dbd13e927f38b7e428d182341eff_JaffaCakes118

Files

ff62dbd13e927f38b7e428d182341eff_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b3459c94b7fb822b3cacf25e590a78e6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegQueryValueExA

user32

GetKeyboardType

gdi32

UnrealizeObject

version

VerQueryValueA

ole32

CreateStreamOnHGlobal

comctl32

_TrackMouseEvent

shell32

ShellExecuteExA

shfolder

SHGetFolderPathA

Sections

.text
Size: 296KB - Virtual size: 984KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE