49e5fbeb6abe967ee39fa3badc49bb64_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

49e5fbeb6abe967ee39fa3badc49bb64_JaffaCakes118
Size

776KB
MD5

49e5fbeb6abe967ee39fa3badc49bb64
SHA1

210503782ba734100d8014b920a2cecf2e659df5
SHA256

37cfaff9ce0054dddad1ebf64991fba8ae041560f488661574b97912966ced7c
SHA512

f21494ec27ad6d23afe4b8a7f26ad7fd0d86a8d4a45960274c218d5ed8cbc8a33763c15ce8ff9100885e02af39bb62483476354e90401e2507f91f240baf2cc2
SSDEEP

12288:WHS3O5RqdTM96D/WO75HJjRkvhUgpFMwQ/mTNtQc40FgIExOOOOOOOOOO:WS3IRqdAoLxhJVG0wXhiDhTB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49e5fbeb6abe967ee39fa3badc49bb64_JaffaCakes118

Files

49e5fbeb6abe967ee39fa3badc49bb64_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0189e42cc500f1e2ea3e50fde27cde47

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
GetCurrentProcess
CloseHandle
LCMapStringA
ExitProcess
LoadLibraryA
CreateFileA

user32

CloseWindow
SetWindowLongA
CharLowerBuffA
CreateWindowExA
wsprintfA

advapi32

RegCloseKey
RegEnumValueA
RegOpenKeyA
RegCreateKeyA
RegDeleteValueA
RegEnumKeyA
RegQueryValueA
RegSetValueA
RegDeleteKeyA

Sections

.text
Size: 585KB - Virtual size: 588KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 404KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 172KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ