f4010fecd959ade222ed2a9bc9d406e3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f4010fecd959ade222ed2a9bc9d406e3_JaffaCakes118
Size

10KB
MD5

f4010fecd959ade222ed2a9bc9d406e3
SHA1

4b32852a0d978faff3c5f3aa5709d6fca64a059e
SHA256

20c2056b9612d3678f92f08149946178f0c785e6944294b02b1546575d8c12ea
SHA512

c68d942f87068ae4b09cf6766c1feb8d9c897e60c53a529b59fbbcae71ca9e4462a08fa2cd189ce576448e80a48d4e3542339ebc63ee8d679650128deacc6540
SSDEEP

192:cgSkgQsxbo77FPRgtN0jLpTF0aUs7iob1wUpZABGHzUTAQWfSkiKv:xTgQsxQRP2tew9S1HABGHo899v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f4010fecd959ade222ed2a9bc9d406e3_JaffaCakes118

Files

f4010fecd959ade222ed2a9bc9d406e3_JaffaCakes118
.dll windows:4 windows x86 arch:x86

cc5cb34a958441137adef6319400370e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapAlloc
GetProcessHeap
GetTickCount
Sleep
VirtualProtect
CloseHandle
CompareStringA
IsBadReadPtr
LoadLibraryA
GetModuleHandleA
GetModuleFileNameA
GlobalAlloc
Process32Next
Process32First
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
GetProcAddress
lstrlenA
GlobalFree
CreateThread
GetPrivateProfileStringA
ExitProcess
Thread32Next
TerminateThread
Thread32First
GetCurrentProcess

user32

wsprintfA
CallNextHookEx
TranslateMessage
DispatchMessageA
GetMessageA
SetWindowsHookExA

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

wininet

InternetCloseHandle
InternetReadFile
InternetOpenUrlA
InternetOpenA

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 714B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ