f49fb418108d70de51af3765dcd24fd3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f49fb418108d70de51af3765dcd24fd3_JaffaCakes118
Size

73KB
MD5

f49fb418108d70de51af3765dcd24fd3
SHA1

14f526bbc9bd1b8f515420680fb97419a808eec7
SHA256

8251fefef50bd819869f08f78e82113a03a3d9f5c4e378b7ccf3a10b3036181e
SHA512

b686c38bc8d268b580ff3951423c967bd58a7ca32f4239da84cc24658cf8d6fbc8596d5a64f24d20d501a56fca548276f29c308767abc0c1490831eb52cd4354
SSDEEP

1536:T/nZ/gnO9w8V7szfQoptTOZ81rWlsDGf:5Nw4j/VLf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f49fb418108d70de51af3765dcd24fd3_JaffaCakes118

Files

f49fb418108d70de51af3765dcd24fd3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a7cb21069032c01d3f01e82629baed99

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetScrollPos
LoadKeyboardLayoutW
GetForegroundWindow
GetMenuStringW
SetDoubleClickTime
SendInput

wininet

ShowCertificate
InternetDialW
InternetGetCookieW
InternetSetCookieW
UrlZonesDetach

msvcrt

iswcntrl
iswcntrl
strcmp

advapi32

LsaOpenSecret
RegUnLoadKeyW
UnlockServiceDatabase
RevertToSelf
LsaClose

Sections

.text
Size: 48KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 20KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE