f0b7952b1d9bb00d981ddde7679d89dc_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f0b7952b1d9bb00d981ddde7679d89dc_JaffaCakes118
Size

76KB
MD5

f0b7952b1d9bb00d981ddde7679d89dc
SHA1

17bac677a4a4c93b2c3620c08251396d1a142676
SHA256

17f21ed98c6667bb0f795e699a11fba14e0eaded90f67be3728bcdf09cd0745a
SHA512

41f67a0d3818b5ea5b31726d109033524ca9764394a085675750aa26694847578bf96707efb0bac39780bd88c703858a15c4629ba325952da365e24d6dac6360
SSDEEP

1536:IQck0fPlOxPxS5HnLV/KjILhaB2ug55I0:bck0fsxZS5Hnxog/I0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f0b7952b1d9bb00d981ddde7679d89dc_JaffaCakes118

Files

f0b7952b1d9bb00d981ddde7679d89dc_JaffaCakes118
.dll windows:4 windows x86 arch:x86

266d22626c7b7aa476a3711caffd15fa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ExitProcess
Beep
ExitThread
HeapAlloc
GetProcessHeap
HeapFree
EnumCalendarInfoExA
GetDevicePowerState
SetEndOfFile
CreateFileA

rpcrt4

RpcStringBindingParseW
RpcBindingVectorFree
RpcBindingToStringBindingW
RpcEpUnregister
RpcEpRegisterW
RpcServerListen
RpcServerRegisterIfEx
RpcServerRegisterAuthInfoW
RpcServerInqDefaultPrincNameW
RpcImpersonateClient
RpcRevertToSelfEx
UuidFromStringW
NdrAsyncServerCall
NdrServerCall2
RpcStringFreeW
RpcServerInqBindings
RpcServerUseProtseqW
RpcAsyncCompleteCall
UuidCreate
UuidToStringW
RpcMgmtStopServerListening
RpcAsyncAbortCall

Exports

Exports

fzbm

Sections

.text
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ