f38049fd4fe8ed65c4e78cd4632893bd_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f38049fd4fe8ed65c4e78cd4632893bd_JaffaCakes118
Size

8KB
MD5

f38049fd4fe8ed65c4e78cd4632893bd
SHA1

46b3901e8862ec5788022e2509392dbfe6736de6
SHA256

8edc87d8d5d665605ee630dbd8dca6a19ea81302fbb3f47da6fb166d3e602148
SHA512

d01b22335fe4d02f73c168e08899a723b0dfd17be75c2b3a389251e6d31641fbc6c12146c764b3db085a81b6adf38312c5c5407424fe2be658476effd6a7dfbd
SSDEEP

96:szXakXSOIXrKOkP3SCervnPaY46wvHUHKrwIfECHQurvTAoP0pv6X4aflLwqC1l:szzXRlOkvSCeTsHrw0H95cv6/Fwq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f38049fd4fe8ed65c4e78cd4632893bd_JaffaCakes118

Files

f38049fd4fe8ed65c4e78cd4632893bd_JaffaCakes118
.dll windows:4 windows x86 arch:x86

b220a131792d886176f482a9568a9a00

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ReadProcessMemory
GlobalLock
GlobalAlloc
CreateThread
GlobalFree
IsBadReadPtr
GetPrivateProfileStringA
Sleep
WriteProcessMemory
GetModuleFileNameA
GetCurrentProcess
WideCharToMultiByte

user32

SetWindowsHookExA
CallNextHookEx

wininet

InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetReadFile

msvcrt

_stricmp
_adjust_fdiv
malloc
_initterm
free
??3@YAXPAX@Z
strrchr
memcpy
strcpy
strlen
sprintf
??2@YAPAXI@Z
memset

Exports

Exports

fx

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 989B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 484B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sdt
Size: 512B - Virtual size: 269B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 602B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ