49b362a994d02e8403aa1fa880d0ad64_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

49b362a994d02e8403aa1fa880d0ad64_JaffaCakes118
Size

8KB
MD5

49b362a994d02e8403aa1fa880d0ad64
SHA1

28706debf51f6604e8070df680f80ffafab133cf
SHA256

2c98a802161294101847d52331db17a15bdb6e634ca337ecf028052b0a56b4d6
SHA512

4658a0a0b9fdaf4242b528de14f5586dadc5170f32b9574b522fa85173499ba84a5b9aef9c32e462bab8982c6c05ff31f8f0f6d6dc07a2d7ac0a575121bf2806
SSDEEP

192:UWBxQHZV31OxBILBTzXQSolgag9O46JBgp:tYlO7ILpzQad90JB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49b362a994d02e8403aa1fa880d0ad64_JaffaCakes118

Files

49b362a994d02e8403aa1fa880d0ad64_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d3f661728cb9638174b23dcb9cf98fba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SleepEx
GetTickCount
GetCommandLineA
Sleep
lstrcatA
GetEnvironmentVariableA
GetShortPathNameA
GetStartupInfoA
QueueUserAPC
IsDebuggerPresent
GetVersionExA
CloseHandle
GetCurrentProcessId
CreateThread
lstrcpyA

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 858B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE