ea09ae97aa2250af94aa003f9e23db66_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ea09ae97aa2250af94aa003f9e23db66_JaffaCakes118
Size

139KB
MD5

ea09ae97aa2250af94aa003f9e23db66
SHA1

4902883af0f61c51b4b81ca823e7f31c863d9306
SHA256

57a1be39b0f3cbe5df73d74008f13307252695c60f5dcb0c1e1b99d84008883e
SHA512

6bdfeddf32400dca021e0de87dd15b8edd42e58ce287b77775f10cc6a55ab764c8b2a87c836a9d9d37c0fdaff28e69b7e279e863f7e31f5dfd6a6a376bfb56fa
SSDEEP

3072:lcXABQN1XMS4RW/b+3zXjTIqP6Rh3Ki6LA9iUd8ilNNiDg:lcQBQL8S4RW/CvTImTNLAASED

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ea09ae97aa2250af94aa003f9e23db66_JaffaCakes118

Files

ea09ae97aa2250af94aa003f9e23db66_JaffaCakes118
.dll windows:4 windows x86 arch:x86

1ed195b58f3f25eea1e5a4b652edb263

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoA
OutputDebugStringA
GetTickCount

dbghelp

SymFunctionTableAccess
SymGetModuleInfoW
SymInitialize
SymSetSearchPath
SymEnumerateSymbolsW
StackWalk
SymGetSymFromAddr
SymLoadModule
SymGetModuleInfo

msvcrt

memset
_vsnprintf

Exports

Exports

_BBNYI@0

Sections

.text
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ