0b498b3b236bef57b0af236435470db2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0b498b3b236bef57b0af236435470db2_JaffaCakes118
Size

82KB
MD5

0b498b3b236bef57b0af236435470db2
SHA1

08a3a64177584b61e78cbed137a81511ef6bffb8
SHA256

e41c260915c00631b94886d8cc1b7678874607c9cbb5304eb0f2c858df88441f
SHA512

1972e36f04b8a3c5622f920517e1b3c34f4557e0110cd6fa0b8dac70438d957204f0921610b9ce60943b178d7988331205952a4022e0e11c354446b0da8bbd47
SSDEEP

1536:6pAshc5w1SUeZzdv5h6RQ+mFjyz9f9bgG8aUHfrtqcE+6MIpedzf7ivbaq:ojgiSUeZlGejyz9f9b6aUDkcEsQedyzl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b498b3b236bef57b0af236435470db2_JaffaCakes118

Files

0b498b3b236bef57b0af236435470db2_JaffaCakes118
.dll windows:4 windows x86 arch:x86

165ec46b0ce8be111621ca5c959b85ac

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

wsock32

WSACleanup

urlmon

URLDownloadToFileA

Exports

Exports

start
stop

Sections

CODE
Size: 76KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE