17f406a8786b3103d6cbe2dacfdef53e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

17f406a8786b3103d6cbe2dacfdef53e_JaffaCakes118
Size

40KB
MD5

17f406a8786b3103d6cbe2dacfdef53e
SHA1

8262266691f38951707adb253dde3e54738d2dbb
SHA256

b494275caef88d71c70d83558a1bdd09f8e5f78a81e30352cdfb5879405719df
SHA512

c6d7f6d2cef2d1c961bfdcb1320640f2feba631f76e1b5964e0e752f1cc75e2aba9f1aa56ba9fd950123458a698fd4e4e54ebc86b9c93f35019dca65961a4d2e
SSDEEP

768:DVdxFHEq7ZLvPykbdmH9YrWXrXySnRTnqT47UT4ugJq9J3owJssumn:DD5t7ykb8ds2rrRO47UT4PJqXBJssumn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17f406a8786b3103d6cbe2dacfdef53e_JaffaCakes118

Files

17f406a8786b3103d6cbe2dacfdef53e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dc8f04aab78432b537f37b8317465c0e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

msvcrt

wcscmp

user32

SetFocus

shlwapi

PathFileExistsA

wininet

InternetQueryOptionA

shell32

SHGetSpecialFolderPathA

advapi32

RegSetValueExA

ole32

CLSIDFromProgID

oleaut32

SafeArrayDestroy

msvcp60

?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ

Sections

.text
Size: 25KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE