0527578318407a41eca42717512c1c51_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0527578318407a41eca42717512c1c51_JaffaCakes118
Size

45KB
MD5

0527578318407a41eca42717512c1c51
SHA1

a7f291aa31a6c2e0f41b9f6e885f268fb72880e6
SHA256

af33ff39adb2bc84668ec86b66723d5f0022ea0723c109ee8b4a485468c1b354
SHA512

404b0d3fd6b1f27780312b740a3e4ab2ae006b89eac6958f57db2c416422e34320fe9b3563d180014939cd9b975b2cf7b1a31f1cae991c926a3407f1dcc193e5
SSDEEP

768:1Xd9FZLvaC1Iuiqxy+xagOLxLXLNZbisGXnd8lqYW2yRZ:nZuSIuDxagOV3N8sUeUU6Z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0527578318407a41eca42717512c1c51_JaffaCakes118

Files

0527578318407a41eca42717512c1c51_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cfef8918eb06fe9cd292b786655a4658

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

urlmon

URLDownloadToFileA

Sections

CODE
Size: 18KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE