0c6200aeda5a760a042283643f4005a8_JaffaCakes118 | Triage

Sharing

General

Target

0c6200aeda5a760a042283643f4005a8_JaffaCakes118
Size

48KB
MD5

0c6200aeda5a760a042283643f4005a8
SHA1

a62e27794d7b54edc6ba4fc399b12dad755c8a3e
SHA256

ec223e046c5f1631ad3e072add00d01f39066655b731748196e071f903f598c6
SHA512

a16b2837486f4ae50c87225baafe326f9ef6bd0f256cb09d5fccb69bff28e8e26347de0628467cb368f1da0657e7b67c607f1b28d19554f48185f2f49628621c
SSDEEP

768:0RZUg+W04e2birpH883JWLcVd5NypJzXo9:0RZBbildZVEHbo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c6200aeda5a760a042283643f4005a8_JaffaCakes118

Files

0c6200aeda5a760a042283643f4005a8_JaffaCakes118
.dll windows:4 windows x86 arch:x86

b0c4eef63444d64ea66cea5a020ff301

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualFree
VirtualAlloc
lstrcmpiA
GetProcAddress
LoadLibraryA
GetLastError
LoadResource
QueryPerformanceCounter
GetSystemTimeAsFileTime
CloseHandle
GetStdHandle
GetStringTypeW
GetStringTypeA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
HeapDestroy
HeapCreate
HeapFree
SetHandleCount
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
HeapAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
LCMapStringA
LCMapStringW
RtlUnwind

user32

GetForegroundWindow

Exports

Exports

atoiSP

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ