48a462b47443a77c1592d59a05ec5a92_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

48a462b47443a77c1592d59a05ec5a92_JaffaCakes118
Size

20KB
MD5

48a462b47443a77c1592d59a05ec5a92
SHA1

a6ff66c8845974e6d7869368cfeadd1f1534f0a4
SHA256

3362ae8b37618d35b77454e55bb021de5554585ea2f87d87533a740cecbfd9e5
SHA512

cb4a3feba6b056ae861a62ef882b5634a6514da8d32a234929afd82c914030561ada434ae8d331d43033a07ee21fbfac16db5f4ae847ffc08d311d8b907355fb
SSDEEP

384:BwpwT4dvthmGoOC0QgdTsOt4nqHSjSyhkA0PtwWyF11rR:xT4dv7mGoOCtgt+nqFyGA0lNO1F

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
48a462b47443a77c1592d59a05ec5a92_JaffaCakes118

Files

48a462b47443a77c1592d59a05ec5a92_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0f0f771634c9020ca426000589ebf13e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtCreateFile
RtlNtStatusToDosError

crypt32

RegQueryValueExU

kernel32

VirtualAlloc
FreeConsole
HeapFree

activeds

FreeADsMem

Sections

.textbss
Size: - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ