b49885ad3170fe15545b8204ab78f298_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b49885ad3170fe15545b8204ab78f298_JaffaCakes118
Size

994KB
MD5

b49885ad3170fe15545b8204ab78f298
SHA1

56c6d5bc5c3bb99007b7e02c7c6e09a0b85998a5
SHA256

09d9b4b7f5f6ea55af3612a547243ed97fc0268dd8a55fe50a3a3b421f492c91
SHA512

880ee4df647b7be5a90b56503821e46d80ca06a872239d922d3185d61f6f1aa577ffecb2365418647e9bf09d81c2329a59ddc71fab2ecc02ea668fc64da5cf1f
SSDEEP

24576:OTGcb87aLKn9F92Y5xsZ1iuRZ/KSwVee6sCV4Uir:WGws9LDmTRECY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b49885ad3170fe15545b8204ab78f298_JaffaCakes118

Files

b49885ad3170fe15545b8204ab78f298_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1edcce69a7ade0d3092b301322895e79

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
CreateFileA
LoadLibraryA
LCMapStringA
ExitProcess
CloseHandle
GetCurrentProcess

user32

CloseWindow
SetWindowLongA
CharLowerBuffA
CreateWindowExA
wsprintfA

advapi32

RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegCloseKey
RegEnumValueA
RegDeleteValueA
RegCreateKeyA
RegSetValueA
RegQueryValueA

Sections

.text
Size: 120KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ