49f6642403a13b698ac7e89723d7c57a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

49f6642403a13b698ac7e89723d7c57a_JaffaCakes118
Size

448KB
MD5

49f6642403a13b698ac7e89723d7c57a
SHA1

38bc431d20cf139d2cb53e65fcd792ce13eee4cd
SHA256

298a560fc3ad1cdcf621b7d84caac539e9740b57c8571091ec6df70af0f55d34
SHA512

3de981f4c257524293edf893a1957d63487fbef835908e2e0c3582db710210bfd37899c3a457b395a4cfa3f493dedae5cec02a1c923c13568919bc378c84e6f1
SSDEEP

12288:baYnZM5ATMTeYhnEktJLcY6+CEs8av2c/W7aZ/qy4v7w6tSK3p:NZU5ThnBthblU+Pa/q17wa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49f6642403a13b698ac7e89723d7c57a_JaffaCakes118

Files

49f6642403a13b698ac7e89723d7c57a_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

c116cfc16e3a5580830487a963b0fc7f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

IsEqualGUID

comctl32

ImageList_SetIconSize

wininet

InternetSetOptionA

urlmon

URLDownloadToFileA

shell32

SHGetSpecialFolderPathA

netapi32

Netbios

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

CODE
Size: 435KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE