0a93d6a6a3bd7e5cdbb1f370350c81dc_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0a93d6a6a3bd7e5cdbb1f370350c81dc_JaffaCakes118
Size

88KB
MD5

0a93d6a6a3bd7e5cdbb1f370350c81dc
SHA1

dd8216ce9bd48c934cd771d6b87b2c1782537293
SHA256

3b837c97e7a9c2dc88be6e110c631361967300e099c05f320611ec63aa64666a
SHA512

0e84be56cfab10ac7ca2829629925256629bd67895b9a25a6364200f277d98882f97fe64378d9fd8874956c9d3c57becfd33836908154fe39257ffa18d945559
SSDEEP

1536:/s/f/5dOwIpB66bfpEZTkBIyt4iXgY4Bt+EiX3PMh60zYwj:/O/zDdoeZIBVtDXgnBtzEkhPzV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a93d6a6a3bd7e5cdbb1f370350c81dc_JaffaCakes118

Files

0a93d6a6a3bd7e5cdbb1f370350c81dc_JaffaCakes118
.dll windows:4 windows x86 arch:x86

af250332dbd4d2d718cb69caf901b6dd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcessAffinityMask
LocalFileTimeToFileTime
OpenFileMappingW
SetStdHandle
CreateNamedPipeA
SetProcessWorkingSetSize
CopyFileW
lstrcpynA
GlobalDeleteAtom
ReleaseActCtx
GetProcAddress
LoadLibraryA
GetFileAttributesA

user32

CreateCaret
DefDlgProcW
GetAncestor
EnumWindows
BroadcastSystemMessageW
TranslateMDISysAccel
GetClassInfoW
CreateDialogParamA
EnumDesktopsW
InsertMenuA

shlwapi

PathIsDirectoryW
PathUndecorateW

advapi32

StartServiceW
RegQueryInfoKeyW

shell32

SHGetPathFromIDListA
SHGetMalloc
SHGetPathFromIDListW

gdi32

GetTextFaceA
TranslateCharsetInfo
SetPolyFillMode

Exports

Exports

DirectEventpnp

Sections

.text
Size: 68KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ