29cac163eb9fa4450ac3e7f2c7640b1b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

29cac163eb9fa4450ac3e7f2c7640b1b_JaffaCakes118
Size

194KB
MD5

29cac163eb9fa4450ac3e7f2c7640b1b
SHA1

c239a0e3f404322fe3bea54664f63a3fe8b556f1
SHA256

6d9c352a0bf4dce1fd94783fd2754e050e032dd83d694b42926646e5eeff4184
SHA512

106d7342e7c3ef7fde37f598ef3751dd0a20051441cd4218ba88f573d2c59cde47998f4a50698d9121b10dbc8311ec81d2e39aa6d6cfd9d90ceb49c5050ba5e2
SSDEEP

6144:UN7TV5nBFi+iQvK50JI9KXkUnIyn3woTOVW49y6eqb/:UN7TV5nBFi+9PI9K/daV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29cac163eb9fa4450ac3e7f2c7640b1b_JaffaCakes118

Files

29cac163eb9fa4450ac3e7f2c7640b1b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bd53b7f50b54a09fce39f7d4b6c2cd5e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetKeyboardType
MessageBoxA

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
DeleteCriticalSection
TlsSetValue
WriteFile
Sleep

advapi32

RegQueryValueExA

oleaut32

SysFreeString

urlmon

HlinkNavigateString

shell32

ShellExecuteA

Sections

.text
Size: 43KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE