2d0ad4b0a253b581f1274332834f1c87_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2d0ad4b0a253b581f1274332834f1c87_JaffaCakes118
Size

80KB
MD5

2d0ad4b0a253b581f1274332834f1c87
SHA1

335a4207e8d1705b7c67aaf3b070a0843aee7d32
SHA256

7dbc1d38b987bc1cdf7da569255352f343bb856583a3f598cc84aafe2f411657
SHA512

7739b07ab5cf7c5172e60312076feabd71584647fd920383bc5eb1e3291c7afbf835ec68d8f8f50cc26dddab350a18032456d5d9786ad126a15edf018dff0ed7
SSDEEP

1536:PqerkytZCMvOLnqS6+q6sgOoXaHPawJCb5huzSPjstYPA0/6S9RU/O3Yd7dyXq:0ytZWv6+qboXWPfAwSPjstYI0fRF5q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2d0ad4b0a253b581f1274332834f1c87_JaffaCakes118

Files

2d0ad4b0a253b581f1274332834f1c87_JaffaCakes118
.exe windows:4 windows x86 arch:x86

86274a3da7672c41f85015674fc5c9f5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

gdi32

TextOutA

winmm

waveOutGetPosition

shell32

SHGetPathFromIDListA

Sections

CODE
Size: 72KB - Virtual size: 380KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE