49b6da656bcf10ba2b5a45780c2dc5b6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

49b6da656bcf10ba2b5a45780c2dc5b6_JaffaCakes118
Size

315KB
MD5

49b6da656bcf10ba2b5a45780c2dc5b6
SHA1

c1365bd16a72d518cd8556e040f726f152a5a09b
SHA256

28c9837d790cbb6d6a0927bd831cf077ed015272c8b3487354b191b99c7237b4
SHA512

170d096c95d03f116c85a5ae909f9c3d0410004aad8b59cc98c08d1f56b4e757037364513e36e27b6b5d80f45bd43fb48a3a2dd9df98eb40036f2f087cdcf475
SSDEEP

6144:uXDXL0BvnjbJDB7VHMkzQB9qnACb1/3Rn:Ib0BPjb37ykeuVJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49b6da656bcf10ba2b5a45780c2dc5b6_JaffaCakes118

Files

49b6da656bcf10ba2b5a45780c2dc5b6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f0c81b6f8530eba9d7b8894954822d1c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegQueryValueExA

user32

GetKeyboardType

gdi32

UnrealizeObject

version

VerQueryValueA

comctl32

_TrackMouseEvent

shell32

Shell_NotifyIconA

Sections

.text
Size: 150KB - Virtual size: 440KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE