49542f61e2288e4f1254a33972955d7b_JaffaCakes118 | Triage

Sharing

General

Target

49542f61e2288e4f1254a33972955d7b_JaffaCakes118
Size

330KB
MD5

49542f61e2288e4f1254a33972955d7b
SHA1

2b3de9cf31c221178af1ac7df7c6e9137410b577
SHA256

88787323d03cbff7c118081407c85dd88dae16b2b11fb8b2848f3f7c0945366b
SHA512

ce20295221da56271dd52ad6beb25ace35f49f5c1181db9212a42f09416c6728c33aeacb46331052f505a9a93b95801e7b9097ebbec11ad8bed970cb9ff40bde
SSDEEP

6144:Uas7XMCjIIINI53xcx8J5uybal9C/8FMm3Jov4sjXg:bs7FIIINIpqxKMyb3mZovy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49542f61e2288e4f1254a33972955d7b_JaffaCakes118

Files

49542f61e2288e4f1254a33972955d7b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

88bdcfb514c36c704b17fb8d11adce4d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
CloseHandle
LoadLibraryA
CreateFileA
LCMapStringA
ExitProcess
GetCurrentProcess

user32

SetWindowLongA
wsprintfA
CloseWindow
CharLowerBuffA
CreateWindowExA

advapi32

RegSetValueA
RegDeleteValueA
RegEnumValueA
RegQueryValueA
RegDeleteKeyA
RegCloseKey
RegEnumKeyA
RegCreateKeyA
RegOpenKeyA

Sections

.text
Size: 4KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 98KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ