fd836e5bba1465b918ce7b7d8a69d7c0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fd836e5bba1465b918ce7b7d8a69d7c0_JaffaCakes118
Size

45KB
MD5

fd836e5bba1465b918ce7b7d8a69d7c0
SHA1

480b2d7e563a31ec2f3e2f4a2817ccada043f0d3
SHA256

d8125a5c7b7c596261ea53488b73df69fcf1b5ed0bf349db508fdf492bfd26f1
SHA512

322d00ac68a4d4fcf37521e6be8843b3678d428a6bd7731af6a9cb541998128fd94d2dea53f5bfaf949f0a645a60ba0d60bc7e63a7b3ad5bc05ab85953ea62bf
SSDEEP

768:CwTukTPTBKhmGjam9HczJqoBRV+CsGlsdnFOeMGVcgSc3NAp/ywxHcvy8jdE:CKNTPmTczJZbXPsdLp38/1x8aP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fd836e5bba1465b918ce7b7d8a69d7c0_JaffaCakes118

Files

fd836e5bba1465b918ce7b7d8a69d7c0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

29d4d9a4e535bff721362e89820bef9e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegQueryValueExA

user32

GetKeyboardType

shell32

SHGetSpecialFolderPathA

Sections

.text
Size: 40KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE