2ae30892ea10e50d308159c1fb1e377d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2ae30892ea10e50d308159c1fb1e377d_JaffaCakes118
Size

99KB
MD5

2ae30892ea10e50d308159c1fb1e377d
SHA1

63a873c30dbf05b95b47e8b7f0664066eccda58f
SHA256

c0ce7eab71c817a280fff51abafa9773c00ece533ff2a90f2d565e579c432e94
SHA512

bd7613cacbf2ccf74dfb59d2a9cf96ee3ba9420d128e95029acb9b9d32286560c73370666e612c844cc41854b58fa5652c0d1ebcf3a46e5279c08a8c92212411
SSDEEP

3072:xHT52mcyVSTITyrNYVPif1birx6wCrp5F:xz5Ay8C2baUw8p5F

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ae30892ea10e50d308159c1fb1e377d_JaffaCakes118

Files

2ae30892ea10e50d308159c1fb1e377d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1900879c98b4a96d399d6ce626330c68

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

urlmon

URLDownloadToFileA

shell32

ShellExecuteA

Sections

CODE
Size: 88KB - Virtual size: 308KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE