05ca562df84451922ed44e2f3ae94a34_JaffaCakes118 | Triage

Sharing

General

Target

05ca562df84451922ed44e2f3ae94a34_JaffaCakes118
Size

8KB
MD5

05ca562df84451922ed44e2f3ae94a34
SHA1

8eefb360df997dacd91cb4b8a23227caa2e7d55e
SHA256

094334cc79a798b6c7976e494186c572b04b1507989e3228b274982e76ee8b17
SHA512

308a6fcb662e5e6cc3e5e59fcd542a0c0def52d5275174d662fee35660d05201e97796424eb63a9e1efc7dbc48e6ee511a2067b07a1dfd531b8761def129e1fb
SSDEEP

192:VUFK5OJ+J3J22koZ7F3FYqtOgdn7SmPdk0czumuelnkZS:aGOwJ3jXR3FPtVlPMumu23

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
05ca562df84451922ed44e2f3ae94a34_JaffaCakes118

Files

05ca562df84451922ed44e2f3ae94a34_JaffaCakes118
.dll windows:4 windows x86 arch:x86

a23647c6f82e20747815b97c429a552d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_except_handler3
strrchr
strstr
free
malloc
strchr
strncpy
_initterm
_adjust_fdiv

kernel32

HeapAlloc
GetProcessHeap
VirtualProtect
GetTickCount
Sleep
CloseHandle
CompareStringA
IsBadReadPtr
LoadLibraryA
GetModuleHandleA
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetProcAddress
OpenProcess
GetCurrentProcess
lstrlenA
CreateThread
FreeLibrary
GetModuleFileNameA

user32

wsprintfA
GetWindowThreadProcessId
FindWindowA
SetTimer
KillTimer
TranslateMessage
DispatchMessageA
GetMessageA

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

wininet

InternetCloseHandle
InternetReadFile
InternetOpenUrlA
InternetOpenA

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 566B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ