0558f026de01964ab19b4f06b171ff6c_JaffaCakes118 | Triage

Sharing

General

Target

0558f026de01964ab19b4f06b171ff6c_JaffaCakes118
Size

13KB
MD5

0558f026de01964ab19b4f06b171ff6c
SHA1

313ab6c6d09c1aea82d399d0640783175677c467
SHA256

cb184f00dff6043fd9379c57b207eb6c60960ff48e3c595160b2fced6b1c731d
SHA512

cc79ef4910a0f5c03902df562f70c8639a2df3f851e16321c4c84ec392cb6d204e1ad57cb3773700f03f95ab038dc59adbf53de4b723ba849f7e6cd1e88805e8
SSDEEP

192:7GrXg96Saxr59VZYrQXDFITti8B4lOpbSJxghyDHh6w6/FerhJZy:CrXs6SaxrviWFIvBIOtyDBzSFeta

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0558f026de01964ab19b4f06b171ff6c_JaffaCakes118

Files

0558f026de01964ab19b4f06b171ff6c_JaffaCakes118
.dll windows:4 windows x86 arch:x86

d20d8ec0c7459eab21bdac914c22d486

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

FindWindowA
GetWindowThreadProcessId
wsprintfA

kernel32

OpenProcess
GetStringTypeA
RtlUnwind
LCMapStringW
CloseHandle
CreateRemoteThread
CreateThread
ExitProcess
GetCurrentProcess
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
GlobalLock
IsBadReadPtr
GetStringTypeW
ReadProcessMemory
RtlZeroMemory
Sleep
VirtualAllocEx
WriteProcessMemory
LCMapStringA
MultiByteToWideChar
WideCharToMultiByte

wininet

InternetOpenA
InternetOpenUrlA

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 974B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 524B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ