48bd989072c76b2abbd7b677257989bd_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

48bd989072c76b2abbd7b677257989bd_JaffaCakes118
Size

164KB
MD5

48bd989072c76b2abbd7b677257989bd
SHA1

a60c333c14ac43057c771ce3aaf3cc3aec4266d5
SHA256

7a8bfecd5594d6c582661690f2a544e1a199c75948959229f98cb5bbe6148e04
SHA512

ae5ffe0d4ce89f7f37cde724233cb16522fe184ade0f6a9d6b383386756853ea14cf9481150dfb3f704429e59bcd9ad47c0565e3575c81aaa3c3ecbc1f18b0c0
SSDEEP

3072:KN1YFH1wkhU+2im57OQSnfyqBpctQ8X/6xQ+M5E4NsTC8n+/:itkhU+2FhIfyoat7X/SQDmT1+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
48bd989072c76b2abbd7b677257989bd_JaffaCakes118

Files

48bd989072c76b2abbd7b677257989bd_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6b14c3cb8e6dd8e8cebd264d16728720

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CharUpperA
GetTopWindow
GetKeyState
CharNextA
wsprintfA
wsprintfW
MessageBoxA
CharLowerA

advapi32

RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA

kernel32

GetModuleFileNameA
LoadLibraryA
GetThreadIOPendingFlag
GetLastError
CompareStringW
TransmitCommChar
CreateFileW
GetProcAddress
CompareStringA
SetStdHandle
FreeLibrary
EnumResourceNamesW
WideCharToMultiByte
CloseHandle
WriteFile
MultiByteToWideChar
CreateMutexA
GetTempPathW
FlushFileBuffers
ExitProcess
InterlockedDecrement
LoadLibraryW
InterlockedIncrement
IsBadReadPtr
SetEndOfFile
SetEnvironmentVariableA

msimg32

AlphaBlend
TransparentBlt

Sections

.text
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crt
Size: 512B - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ