4490dbf364acef25b48a489dddae52f4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4490dbf364acef25b48a489dddae52f4_JaffaCakes118
Size

1.5MB
MD5

4490dbf364acef25b48a489dddae52f4
SHA1

5e1a1f150b801d8007a4be1d2c74def0e37ce25e
SHA256

a394299fddc083f56551d2abffe04937c2eed67fd9c5afb0f9e9feb3a0559ed7
SHA512

1c6b354100296f572753e86f2167de191d1d8a490291bdf0f3324a0baaee1742dffb4028793b50b09c29a294ded3d6f5dcfb8a0611e0b3180eb8e2c557844964
SSDEEP

24576:eATNp6b5OAjCCEXcb9SMo54XeNkPRDaWlRHElCBO3tHgVwU0recux748WzT:D/6IAWvXwhQ9NkPR2qfrKU0qf2/zT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4490dbf364acef25b48a489dddae52f4_JaffaCakes118

Files

4490dbf364acef25b48a489dddae52f4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

92b0e02645c36ee4d1d5886105c109fe

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFilePointerEx
HeapLock
IsValidLocale
FreeUserPhysicalPages
SetCommConfig
SearchPathW
GetFileSize
DeviceIoControl
GetLogicalDriveStringsA
CallNamedPipeA
IsBadStringPtrW
ReadConsoleOutputA
GetCurrencyFormatA
SystemTimeToTzSpecificLocalTime

user32

DdeGetLastError
GetPropA
SetTaskmanWindow
SwitchDesktop
VkKeyScanExW
ChangeDisplaySettingsW
EnumClipboardFormats
GetClientRect
EnumDesktopWindows
LoadAcceleratorsA
InSendMessage
IsClipboardFormatAvailable

shell32

SHChangeNotifySuspendResume
SHGetFolderPathW
SHGetDesktopFolder

Sections

.text
Size: 9KB - Virtual size: 190KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE