252ec60966a4e249d1fecbea52519438_JaffaCakes118 | Triage

Sharing

General

Target

252ec60966a4e249d1fecbea52519438_JaffaCakes118
Size

8KB
MD5

252ec60966a4e249d1fecbea52519438
SHA1

25cb1acd8537e08bcfcb13599f4c625f58a64815
SHA256

5ef0e2ba35f20f8b9401aa29e689893971d591a084dd659b06ad6e349279e0e1
SHA512

f56f8c40c51a9ab248a9cbcd24233b2429f58f40be2e3de9a2e23a99a24779551fc9eb12f94d1a0e499147ecb653c41126e41420dc2b71664b35e08f38c0214e
SSDEEP

96:SfFHWboL8oQOedmDtPC0TQ0ZdUM/SyhGvQd2BLELziOWDgWOWq0ZJ:UF2MLJPCOQsUoSyhGvtSt50Z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
252ec60966a4e249d1fecbea52519438_JaffaCakes118

Files

252ec60966a4e249d1fecbea52519438_JaffaCakes118
.dll windows:4 windows x86 arch:x86

b36a305df0501982b115879ae3c3bd4b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

CreateThread
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
LoadLibraryA
lstrcmpiA

shlwapi

PathStripPathA

Exports

Exports

Install

Sections

.text
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.cdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ