49ac30b47a39e976c9e534d2faacb5f0_JaffaCakes118 | Triage

Sharing

General

Target

49ac30b47a39e976c9e534d2faacb5f0_JaffaCakes118
Size

29KB
MD5

49ac30b47a39e976c9e534d2faacb5f0
SHA1

546d121cda702012b6299a6e3c77809ffb60a642
SHA256

02b0d0c5c50b9652928dea02bcfbf651e148e2b112d75d34dbb4de0ed4da6cbd
SHA512

373c11caead651e6470104770f29cfbf93ac5f6080ac771b4683f34a5218069718713781e81369902c700306766b21751dc43946cf33f7a44f99e59b271c27fe
SSDEEP

768:D2fclWBn41jyruyxTUg6omSAwVhDuFEC7pZb:1cBn4paRYPp4hDiEC7pZb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49ac30b47a39e976c9e534d2faacb5f0_JaffaCakes118

Files

49ac30b47a39e976c9e534d2faacb5f0_JaffaCakes118
.dll windows:4 windows x86 arch:x86

5d2b102baf3c64695d28c9a84d98000f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardState

advapi32

IsTextUnicode

ws2_32

__WSAFDIsSet

wininet

InternetSetDialState

urlmon

URLDownloadToFileW

Exports

Exports

CheckUpdate
CheckUpdateDone

Sections

.text
Size: 23KB - Virtual size: 188KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE