2fa8fe757c6334971b9a8f6700dcbd2b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2fa8fe757c6334971b9a8f6700dcbd2b_JaffaCakes118
Size

959KB
MD5

2fa8fe757c6334971b9a8f6700dcbd2b
SHA1

3ae70c4263e2a29205bcb1da4030a26492496fea
SHA256

a83ce752129c4e0461fe9ad86b6a6cdc21fe7c0ff915fca8bc49977e183cbad5
SHA512

4015156e80cc24b9a87ed21a6f34421c6d64c969854895988b00c610e52df23a59af6366540d422404450bd6454081c5ea3ee8340c2ebff8e34044222bc47c04
SSDEEP

24576:dMB9xM86SRihQ4rEne02INTcS30kgGBdl0qEp/OoW:dYM8XhQjNIxF5WqEpmL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Harry Potter And The Deathly Hallows Part 1 v1.0 + 4 Trainer.exe

Files

2fa8fe757c6334971b9a8f6700dcbd2b_JaffaCakes118
.rar
Download more trainers and updates.URL
Harry Potter And The Deathly Hallows Part 1 v1.0 + 4 Trainer.exe
.exe windows:4 windows x86 arch:x86

047488bf083a558c7385432b238527c0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

OleUninitialize

comctl32

ImageList_SetIconSize

shell32

Shell_NotifyIconA

comdlg32

GetOpenFileNameA

winmm

timeSetEvent

imagehlp

SymSetSearchPath

Sections

CODE
Size: 935KB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
README.txt
file verification.txt
h4x0r.nfo