49aef22aa257dae2bee39daed753ecd9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

49aef22aa257dae2bee39daed753ecd9_JaffaCakes118
Size

23KB
MD5

49aef22aa257dae2bee39daed753ecd9
SHA1

b39946fee5792e05e134f54c3feb611e773b173e
SHA256

2330379d9b6d9afcce9cd6fa7db63e06909ff408abe148ab7a264840aaff2421
SHA512

11a50bb8f1e7d31a5b88727965054b003954699ef84fa157a1272e10a4703b20440df59e115536d882de7b14d1bda71946aeaa5887b63b07ff47fb420a80ce8d
SSDEEP

384:4QORBtMTy9MW/8AoWoFQ273eLXVBYkkjuv1hkNLdbaLa4CwUJuUCSFCJWe8EDEWW:hitMTy92AgEVBxkjuv7wbaLa4PU48IM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49aef22aa257dae2bee39daed753ecd9_JaffaCakes118

Files

49aef22aa257dae2bee39daed753ecd9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9fea3de9773bdfd6311986e6a527827f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenProcess
WinExec
GetModuleFileNameA
GetWindowsDirectoryA
WriteFile
GetProcAddress
LoadLibraryA
CreateFileA
GetTickCount
GetTempPathA
GetSystemDirectoryA
Sleep
GetPrivateProfileStringA
lstrcatA
DeleteFileA
DuplicateHandle
GetCurrentProcess
FreeLibrary
CloseHandle

user32

wsprintfA
MessageBoxA

advapi32

AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA

msvcrt

atoi
_stricmp
_except_handler3
strrchr
_itoa

netapi32

Netbios

Sections

.data
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ