4d99e5819441d40660197d2f0fe36a69_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4d99e5819441d40660197d2f0fe36a69_JaffaCakes118
Size

2.2MB
MD5

4d99e5819441d40660197d2f0fe36a69
SHA1

7b1b72dbcaf64228b4daeb611d86fdf6bfaf3e39
SHA256

e52b25d0f816cb4e0407db74757f91cf4edcf1ffe62798d9c591b5ff336e43cb
SHA512

00023b67c4a112dd3922997de8b122d7932551ff737993dc15686c8756944fabc7b8bf74636f90ee298bcfc0a201c9063bb95afb6ace3d4124d23578cb27adf1
SSDEEP

49152:4uSbRpmwbvIYOo3N8iH3MwBD0PgHwulzKCM5PoslcI17:4uMNbv/L3N8iVD0P0wulzMoslX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4d99e5819441d40660197d2f0fe36a69_JaffaCakes118

Files

4d99e5819441d40660197d2f0fe36a69_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6d46664388691d2c5cd75b11672893a5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

version

GetFileVersionInfoSizeW

user32

RegisterClassW

advapi32

RegFlushKey

ole32

CoInitializeEx

shell32

ShellExecuteW

oleaut32

VarUI4FromStr

shlwapi

PathIsDirectoryW

gdi32

CreateRectRgn

urlmon

CreateAsyncBindCtx

userenv

UnloadUserProfile

crypt32

CertGetNameStringW

psapi

EnumProcessModules

wininet

InternetCloseHandle

wintrust

WinVerifyTrust

Sections

.text
Size: 2.2MB - Virtual size: 8.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE