56156838842f6cc4014a685a807bbdac_JaffaCakes118 | Triage

Sharing

General

Target

56156838842f6cc4014a685a807bbdac_JaffaCakes118
Size

167KB
MD5

56156838842f6cc4014a685a807bbdac
SHA1

9134a962508c5b0fd3800a478c3cfe411dfe95fa
SHA256

11ba5e055cfa28658cafad221277c26d7f5e492490ae79097a0802f7e6767597
SHA512

e214373828a02265c29ed33a19dbba5fb21636c2a5e70982974accc603977b28679266f03b3da8dd18b3f48ddaff0258b198a1f27f87711d46b9a0352bbaa70b
SSDEEP

3072:5wFeo6aIfmgLm9JCBROdp30JnL5LH/EmUhwcMviUeEXm4hkGR:8eoIPgJCBR/JL5LfrJznPXoq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
56156838842f6cc4014a685a807bbdac_JaffaCakes118

Files

56156838842f6cc4014a685a807bbdac_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f6e9f842ad3d764ea0e45106a86af42c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetKeyboardType
MessageBoxA

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
DeleteCriticalSection
TlsSetValue
WriteFile
Sleep

advapi32

RegQueryValueExA

oleaut32

SysFreeString

urlmon

URLDownloadToFileA

Sections

.text
Size: 21KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE