4489eec3f9bf63f0416d18b3365f3db9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4489eec3f9bf63f0416d18b3365f3db9_JaffaCakes118
Size

888KB
MD5

4489eec3f9bf63f0416d18b3365f3db9
SHA1

b1911bf0a3314b8611d3a71a4a2dca52a8d6182f
SHA256

9753a79884c917610b2c44b9bfa21a258e9198328936d3eddbf6645d0f26f084
SHA512

3b1f8038aa1be33cf546e0da36f56228fbacad226aa4efc164fd1b295785a41887aa5d9f28705ecee08c1a20aa08c020fb7918a16e0b816a1da8fa6e7d00c6b4
SSDEEP

24576:MKTAakshwXS3HPDbzqGZ2TG3aPb4uXBr9:RAaVTHr3hAfzB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4489eec3f9bf63f0416d18b3365f3db9_JaffaCakes118

Files

4489eec3f9bf63f0416d18b3365f3db9_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b187e5895b0a431bfe98208adc4c5f29

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExW

wininet

InternetSetOptionW

msvcrt

_XcptFilter
exit
_acmdln
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_exit

comdlg32

PageSetupDlgW
PrintDlgExW
ReplaceTextW
GetFileTitleW

kernel32

GetProcAddress
GetLocaleInfoW
MultiByteToWideChar
GetCPInfo
GetACP
LoadLibraryExW
MulDiv
CloseHandle
SetEndOfFile
GetFileSize
GetLastError
ExitProcess
VirtualAlloc
GetStartupInfoA
GetModuleHandleA

secur32

InitializeSecurityContextW

Sections

.text
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.n77s0u
Size: 825KB - Virtual size: 825KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ