08738a8add07ea90ada2e491de44dd30_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

08738a8add07ea90ada2e491de44dd30_JaffaCakes118
Size

24KB
MD5

08738a8add07ea90ada2e491de44dd30
SHA1

baa438c8c291b8b0d9d67167f56a8e5d2c1e43cb
SHA256

84d2e754d6ec48ae4a8eacbbfad4c1f609103a1a65efc94ec6d967c1e0e324c4
SHA512

625aa96dd81741c294463e648834f7fbc1dc76eba7aa94f057617ec4713f7809dec00e3f0a4cf016f837f89a8e923851dd751cf0a6cae9a7f7009c8b2ce1a615
SSDEEP

96:zFP3GKevrUAWteCoEFMrHbSzhe6CY/vmhtRebCSud90QWiafxovn1/RXISrzd:RPreGteCnCbSzhe62rehfmPBR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
08738a8add07ea90ada2e491de44dd30_JaffaCakes118

Files

08738a8add07ea90ada2e491de44dd30_JaffaCakes118
.dll windows:4 windows x86 arch:x86

ac329ba1c4ffb0576e2d8079d401b872

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
WriteFile
SetFilePointer
CreateFileA
lstrcpyA
GetCurrentThreadId
GetProfileIntA
GetCurrentProcess
GetProcAddress
LoadLibraryA
lstrcatA
GetCurrentProcessId
GetLocalTime

user32

ToAscii
GetKeyboardState
CallNextHookEx
GetWindowTextA
wsprintfA
GetActiveWindow
GetProcessWindowStation
GetThreadDesktop
OpenWindowStationA
OpenDesktopA
SetThreadDesktop
SetWindowsHookExA
SetProcessWindowStation

msvcrt

_adjust_fdiv
malloc
_initterm
free

Exports

Exports

KSK

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 967B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Share
Size: 4KB - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ