49bc540a13da9c79a36fd1dbaf09cf32_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

49bc540a13da9c79a36fd1dbaf09cf32_JaffaCakes118
Size

114KB
MD5

49bc540a13da9c79a36fd1dbaf09cf32
SHA1

ca3284d084467c26e6da0c0cb886b2068b9ab93d
SHA256

51566072a3feb962513ae721738e6f80ed0f939858f3deee7067c9ad2de34ae8
SHA512

2387d6c4e54c66dd0ee443fc0e4449b52306803ede1e40b11554fb16340addc210883ad38d573ae1f1009dc8511cd6a69040b83ae4deab19944372a1255f3834
SSDEEP

3072:RpayE058coEUB3GReLkZjtjYpkH9Pt1sCEz47Q:RpQE8OTeLkDsA9Pt+CEs8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49bc540a13da9c79a36fd1dbaf09cf32_JaffaCakes118

Files

49bc540a13da9c79a36fd1dbaf09cf32_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8e1a7c891f6a8730e7f93eacf0de4cae

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpyA
GetCommandLineA
GetModuleHandleA
GetLastError
GetTempPathA
lstrlenA
GetStartupInfoA

user32

DialogBoxParamA

msvcrt

_acmdln
isalnum
strlen
memset
malloc
memcpy
free
isprint
islower
isupper
_exit
_XcptFilter
exit
isspace
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 884B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ