0aba17ae83022bacb3b5a9b573ecda9c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0aba17ae83022bacb3b5a9b573ecda9c_JaffaCakes118
Size

143KB
MD5

0aba17ae83022bacb3b5a9b573ecda9c
SHA1

c44de2734cdf9f24bd64dac62c7f7942780abd4c
SHA256

0ec06fb1ecd007ea2541b253663ab5ed6481ad884753bbb2647e229a40df85c1
SHA512

3137c9d0188c697a851bff74d33964d9cdd0d21e0fecaab354c7653f2e64fb3e2f1237a1b765d035d71586069958134470c86be1e9dab5a817a271857aeaf4d9
SSDEEP

1536:QzdnhbR6rkDiQDbjzklXHWs7SCHF3MovhgmMALtgtaCT9kgUKR+uzlUqNPyaTUYQ:Qz7RrIZSQhhrgta65R+uFN6a2hrIQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0aba17ae83022bacb3b5a9b573ecda9c_JaffaCakes118

Files

0aba17ae83022bacb3b5a9b573ecda9c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d2bbddb8c010773f04c2d9dd29668462

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

UnrealizeObject

comctl32

ImageList_SetIconSize

shell32

ShellExecuteA

urlmon

URLDownloadToFileA

Sections

CODE
Size: 132KB - Virtual size: 380KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE