49259c428ca5ba59fa5501b2ac8a0925_JaffaCakes118 | Triage

Sharing

General

Target

49259c428ca5ba59fa5501b2ac8a0925_JaffaCakes118
Size

89KB
MD5

49259c428ca5ba59fa5501b2ac8a0925
SHA1

0df16805bde4fefa18d3ffcbc60be601809b6ab4
SHA256

18c7be2575e19ebff2bbd1ff70a6d07c04f3fb6bd3491d7b93659c44018ee340
SHA512

4fdb4a6876045968c609b7e2ef85fb2de5c56b42948ed159517ca33ee178a643f2ea8aabd142c8e3b03bbde463bd9777b30e649deafbb6c3d6b85f4fc7108bc7
SSDEEP

1536:ISvyJazTCuiwrDtdaRKdT7OSqrnF/E0m:fhzTCuHvawt7OSu6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49259c428ca5ba59fa5501b2ac8a0925_JaffaCakes118

Files

49259c428ca5ba59fa5501b2ac8a0925_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ace7d05e3ed98cceadeee74b6a85e23b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindVolumeClose
FindAtomA
lstrlenA
CloseHandle
GetModuleHandleA
GetConsoleFontSize
GetLastError
SetEvent
CreateThread
FindClose
Sleep
TlsGetValue
GetDiskFreeSpaceA
ReleaseMutex
DeleteCriticalSection
VirtualProtect
FindResourceExA
SearchPathA
ExitProcess
GetTickCount

user32

EndDialog
GetMessageA
DialogBoxParamA
GetKeyState
GetScrollBarInfo
IsIconic
DispatchMessageA
CopyImage
CloseWindow
CreateWindowExA
CreateMenu
EnableWindow
DragDetect
CopyIcon

wshbth

WSHNotify
WSHOpenSocket2
NSPStartup
WSHIoctl
WSHJoinLeaf

advapi32

RegCloseKey

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 522B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 81KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE