3deceb15cc26570e042dbd232c54572f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3deceb15cc26570e042dbd232c54572f_JaffaCakes118
Size

823KB
MD5

3deceb15cc26570e042dbd232c54572f
SHA1

3ece792acd5dd4161e01d8bbd8a4bd62ed90b8f2
SHA256

b98715e1711a97551c3d0a188a3391f38b7956e6a8c25c088c952525b049704e
SHA512

9b900d3374e7bc079cebe312fc5170ec3bb55258c959d7d21399993d71472e1419da4cfd4758206f528c1437a8411949d1ee60031cb26d2664a13b46bfbd8bd8
SSDEEP

12288:kF5jA5Y77Lw/ohZAdkCt4l/tw9Zy6CcazNI12T+xCm/czgbGEYd1dbiyg1bm79Du:kXjA5Y7PLZ7Ct0/yGGkzg7Yd10i9DF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3deceb15cc26570e042dbd232c54572f_JaffaCakes118

Files

3deceb15cc26570e042dbd232c54572f_JaffaCakes118
.exe windows:5 windows x86 arch:x86

0c888e133105308885f3999fbfc70287

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

wsock32

__WSAFDIsSet

version

VerQueryValueW

winmm

timeGetTime

comctl32

ImageList_Remove

mpr

WNetCancelConnection2W

wininet

InternetReadFile

psapi

EnumProcesses

userenv

CreateEnvironmentBlock

user32

SetWindowPos

gdi32

DeleteObject

comdlg32

GetSaveFileNameW

advapi32

RegEnumValueW

shell32

DragQueryPoint

ole32

OleSetMenuDescriptor

oleaut32

SafeArrayAllocData

Sections

.text
Size: 636KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 98KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE