41dbe6f583c7409488229615db45c2c2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

41dbe6f583c7409488229615db45c2c2_JaffaCakes118
Size

348KB
MD5

41dbe6f583c7409488229615db45c2c2
SHA1

87b4191d2284e0ab5913192dde5c4a438cd339a7
SHA256

c9fc0f0523677bb1ec31a9d269a6adca199debc52b35974008d3f537d361ab7e
SHA512

0d1b88673a79b29fce18eacd840a740f678d5d2c5fc1e4f8e82c6a708f75356a5305ef1ee77c41f83da95e10605d940f904d592f9f77af5fb31668ed36ad4247
SSDEEP

6144:v5FQYt2cpeekZ3OwR/ixCzAoOoTgx6USad9eSihMcdFA20UPGyhmN:R2weekZVuCdex6UFHihHFANqhsN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
41dbe6f583c7409488229615db45c2c2_JaffaCakes118

Files

41dbe6f583c7409488229615db45c2c2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9e23df87b0400ca7acc04b224fa573f1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetKeyboardType
CreateWindowExA

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
DeleteCriticalSection
TlsSetValue
lstrcpyA
Sleep

advapi32

RegQueryValueExA
RegSetValueExA

oleaut32

SysFreeString
SafeArrayPtrOfIndex

version

VerQueryValueA

gdi32

UnrealizeObject

comctl32

ImageList_SetIconSize

Sections

.text
Size: 21KB - Virtual size: 420KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE