129345e5dae992541802df41cb1dcf00_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

129345e5dae992541802df41cb1dcf00_JaffaCakes118
Size

310KB
MD5

129345e5dae992541802df41cb1dcf00
SHA1

02ac368c46b151360b5a80b327adc736354a4692
SHA256

ea003ea94d2ca94adfbc46df825a07702c8e90c2b5cc5ba9d215a0b60d64d571
SHA512

10a4549449d5c05792aedfce1e86b49ac65058d4b8adaf65e5e3aa23d28c43eb5c0b7129d63a4be195a141183057ec816427b5fcd7422acf46bd99211780fe65
SSDEEP

6144:liPG8/8drckeW4K06S7JCWVwlAjQbWISY6wDIqs3tvl+kCqIcL7u:lj8YnP0DTQxC53wDK39bCqIc/u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
129345e5dae992541802df41cb1dcf00_JaffaCakes118

Files

129345e5dae992541802df41cb1dcf00_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b07e05e04e2dd93e4baf77450eba9433

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

advapi32

AdjustTokenPrivileges

comctl32

ord17

gdi32

DeleteObject

ole32

CoCreateInstance

shell32

SHBrowseForFolderA

user32

CharToOemBuffA

Sections

.text
Size: 35KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE