49c4897ab3c5f7054bd6aaf28034f5cd_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

49c4897ab3c5f7054bd6aaf28034f5cd_JaffaCakes118
Size

177KB
MD5

49c4897ab3c5f7054bd6aaf28034f5cd
SHA1

8eb10d6cc0560e4306f63d1ecf1cfc6b99f625d2
SHA256

304e7ffce616991bf0bbc3aeef95a47adfa21ad1ef956f1915c52eec3941bb06
SHA512

f8bb366ae3f2df4640154a5e6dc8d179aa9e962690bf2bee3751e8cacf4c265cfdecbccc5c88351c8c78b87d9ced282be7c0928ee9833e153315a9f74868ee1f
SSDEEP

3072:bih3DrKbK1vHa1wHx7N9i/sHu74/zhddIuz+giPEdNuLhoVDlbm+p77:bihfKbES1wNNre47jd/gEvChoVDpX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49c4897ab3c5f7054bd6aaf28034f5cd_JaffaCakes118

Files

49c4897ab3c5f7054bd6aaf28034f5cd_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bb049c68c818425a04e85aeb94eeb647

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

NdrFixedArrayFree
UuidCreate

advapi32

RegCreateKeyExA
RegEnumKeyExA
RegOpenKeyA
RegCloseKey
RegQueryValueExA
RegDeleteKeyA
RegOpenKeyExA
RegSetValueExA

shell32

Shell_NotifyIconA

kernel32

FlushInstructionCache
FindFirstFileA
FindResourceExA
DuplicateHandle
EnumResourceNamesW
SetEnvironmentVariableW
UnmapViewOfFile
MapViewOfFile
GetModuleFileNameW
FindClose

winmm

timeEndPeriod

Sections

.text
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 796B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ