392b70f02a4973b15d53fabe885579d1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

392b70f02a4973b15d53fabe885579d1_JaffaCakes118
Size

33KB
MD5

392b70f02a4973b15d53fabe885579d1
SHA1

e07a0fab4273f66ce4a2a1b827316ae615f44e2d
SHA256

dad1a10bfb380b5d1a3037c616cb9894387a96bbfd1d1fb1dfbdfcdd64537d1c
SHA512

eab325cc7f513c22deca7d4ced359104a841ce15bb068d1f766ad2c4b8bc081e7ad251af1066fb0e7ea322693ddcd40c8a4c3726a01d467bd726b1c33368bbfc
SSDEEP

768:9+Qf/xxdFdMmYAjPe5FBqWnln/R9eKw5bifYG:Mcvl3wH55i

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
392b70f02a4973b15d53fabe885579d1_JaffaCakes118

Files

392b70f02a4973b15d53fabe885579d1_JaffaCakes118
.exe windows:1 windows x86 arch:x86

7d7c3ff539676c9bd771c495fec10b96

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

VariantChangeTypeEx

urlmon

URLDownloadToFileA

Sections

CODE
Size: 18KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE