0228126f01ec1895150c87844db32182_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0228126f01ec1895150c87844db32182_JaffaCakes118
Size

44KB
MD5

0228126f01ec1895150c87844db32182
SHA1

d21206049acaefe8465a1daf9f7e6401e4fa0de3
SHA256

e366abd3b9aeb1330935916be03500b5ad4ac453812d1c92337b3ac161add8f6
SHA512

88e5cf2474cf82b645a1ec251bef65573f493e944f8d3d88a735381d13b0b521eb09c81bdf8eacf4ad3c51912d999c84677e1fd2206ac97e735f95562489d647
SSDEEP

768:zDRQOTyx8YrmP4n3AN+dPWvfXB7Ts5bEOVz:nRLTyx8imP4n3ACPEB7w5nz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0228126f01ec1895150c87844db32182_JaffaCakes118

Files

0228126f01ec1895150c87844db32182_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1900879c98b4a96d399d6ce626330c68

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

urlmon

URLDownloadToFileA

shell32

ShellExecuteA

Sections

CODE
Size: 16KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE