3ebb6e93ba497658bc3e81e034961ae1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3ebb6e93ba497658bc3e81e034961ae1_JaffaCakes118
Size

256KB
MD5

3ebb6e93ba497658bc3e81e034961ae1
SHA1

d88d076071583a6396ad9dc97ba284b2dd318903
SHA256

dfb3cf8870195178b5535620c63f8326236ff025098acf6dcf177a25739033de
SHA512

763ea0cde601979d741b88f3bcec272741395190497879faa88a4edd735147b6a4fbbec7e4c79e7d94e09b804146dc7d7c99230cca8a054d332f99ace49ca94b
SSDEEP

6144:n8IAxcJ/SnQH45VIHx81uzoZEeB88BQ2CzcEKOhTR5N0YZbhh4WK:8IAyk75VqxbzoB8ZgELZPq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3ebb6e93ba497658bc3e81e034961ae1_JaffaCakes118

Files

3ebb6e93ba497658bc3e81e034961ae1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

498f1c3b1cfdd1f6431d4d43ce7429d6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetKeyboardType
PeekMessageA

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
DeleteCriticalSection
TlsSetValue
WriteFile
Sleep

advapi32

RegQueryValueExA

oleaut32

SysFreeString
SafeArrayPtrOfIndex

Sections

.text
Size: 19KB - Virtual size: 256KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE