f497fecaa55abe56127391c76c6e5ca4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f497fecaa55abe56127391c76c6e5ca4_JaffaCakes118
Size

4KB
MD5

f497fecaa55abe56127391c76c6e5ca4
SHA1

16423f9372a9936bde597609cec5c12388a94730
SHA256

7f799d25b83ab33226e8030da61a1581cd589fb6d1ea7ff15d8fa64e7529d630
SHA512

1a31c2703852cd4bc9f3fbcb4a93da3ab672ffa942fc6b8213ba655306dad166584c18d8c2e4a7efb88daf51d11aee87da4a6d4e3b1dbec776a14d58c93ad55a
SSDEEP

96:eQyMnZ9/Mrgk+cw9ztw46Hc0Xmed9WA61D:eQnL8tvXmeHWA6p

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f497fecaa55abe56127391c76c6e5ca4_JaffaCakes118

Files

f497fecaa55abe56127391c76c6e5ca4_JaffaCakes118
.dll windows:4 windows x86 arch:x86

9d3ecee939b999abe6cd59a987a72baa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

ZwLoadDriver
RtlImageNtHeader
RtlAdjustPrivilege
_snprintf
strchr
RtlAnsiStringToUnicodeString
sprintf
_stricmp
ZwOpenEvent

kernel32

GetTempFileNameA
LoadLibraryA
InterlockedExchange
GetProcAddress
LocalAlloc
CreateThread
GetTempPathA
CloseHandle
MoveFileExA
FreeLibrary
SetEvent
GetLastError
VirtualAlloc
RaiseException
GetModuleFileNameA
GetModuleHandleA
LoadLibraryExA
VirtualProtect
OutputDebugStringA

Sections

.text
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 190B - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ