ff13bd79da78807451cb2e10cb8a1c98_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ff13bd79da78807451cb2e10cb8a1c98_JaffaCakes118
Size

31KB
MD5

ff13bd79da78807451cb2e10cb8a1c98
SHA1

34c7edab6e67e63891e305bc71cf45a01cf26468
SHA256

a42cca06574aa125fb6dbb432f448ff6d3121176ec611b5454f314ba01d850b4
SHA512

f7f34de20179a91a9a8c3c2cf280c372cabd05d88366527fd1c60a9c9aec43e4e9b4259998428034699ca2260527e045d676ce83f70f1492d74fe2da1eb9ca84
SSDEEP

768:/d9FZLvaC1IhIYYsM0OsbsNU21skdbuyUr:VZuSIhdYsjbsNvbuP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff13bd79da78807451cb2e10cb8a1c98_JaffaCakes118

Files

ff13bd79da78807451cb2e10cb8a1c98_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9534fcd0f693009c88102eb0630b67fe

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

urlmon

HlinkNavigateString

Sections

CODE
Size: 18KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE