490d7500241da09a96d0e0c5cf93b052_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

490d7500241da09a96d0e0c5cf93b052_JaffaCakes118
Size

56KB
MD5

490d7500241da09a96d0e0c5cf93b052
SHA1

d9abf49322dd95debf45f21866806a557c657130
SHA256

46795d9052b47a97069bf7e2224b43849b5357038dcb5676de34c7716784def1
SHA512

7156ac3efcc4abfe8d9c191f5c4530e76cf5dec161ae1b44ff71cb1493055f231216688d1b4bf3a7a40d83421edd159fe76d5dd4698b478d7620144b28bf65be
SSDEEP

768:DGACN3QKo+iVi1X9H77BK+CRLAh1DUM6x6LHAF8izIFcOoKTe2fusdDp:DRClt77BeRLAjUn62b3KTe6dD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
490d7500241da09a96d0e0c5cf93b052_JaffaCakes118

Files

490d7500241da09a96d0e0c5cf93b052_JaffaCakes118
.exe windows:4 windows x86 arch:x86

37ab09a6edbf9fbf08aa53c4b4e64002

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
lstrcmpiA
VirtualAlloc
VirtualProtect
IsBadReadPtr
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetStartupInfoA

user32

DefWindowProcA
SetTimer
GetMessageA
TranslateMessage
DispatchMessageA
KillTimer
SendMessageA
LoadIconA
LoadCursorA
RegisterClassExA
CreateWindowExA

msvcrt

_XcptFilter
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
free
_beginthread
_exit
malloc
exit
_acmdln
__getmainargs

Sections

.text
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE