0d3d25c3ef13461f18794ef2060860b9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0d3d25c3ef13461f18794ef2060860b9_JaffaCakes118
Size

144KB
MD5

0d3d25c3ef13461f18794ef2060860b9
SHA1

14436ce29d5a2535e95c9b8fed86b935451b8bc0
SHA256

0e5a6514d5d9ed5f70c4cb61fb94a1d7131e26c2180daceb4bb9b886f50947a8
SHA512

6e98aab346435fcc0b391c83da998a3440e598ce22ecd063f0c75479586a64fd81cd481b34c64f7a1d595bb64e55f04265a081613054cb5cffd71f1b47355682
SSDEEP

3072:1B3KXBpO3qDeO3I01A4p2jRF38IHhBaz2K0Nt2iu:DKXjO3QeO401ZiRSuTa6ZCiu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0d3d25c3ef13461f18794ef2060860b9_JaffaCakes118

Files

0d3d25c3ef13461f18794ef2060860b9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d2bbddb8c010773f04c2d9dd29668462

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

UnrealizeObject

comctl32

ImageList_SetIconSize

shell32

ShellExecuteA

urlmon

URLDownloadToFileA

Sections

CODE
Size: 133KB - Virtual size: 388KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE