0cb5dd8a660f268f61714120bbf3ae08_JaffaCakes118 | Triage

Sharing

General

Target

0cb5dd8a660f268f61714120bbf3ae08_JaffaCakes118
Size

10KB
MD5

0cb5dd8a660f268f61714120bbf3ae08
SHA1

5bb03a0c28c12268ba6727d6463f920db4684c4f
SHA256

50575547f180c9d38cde3fb8e2bea0bed110ca533c6a728e48a8b2d0a0bc53f1
SHA512

24e1bf28446d3c6e882d65a9353ee675fbd526c2cea00774fa6401222944bd957827207ce5e68ff1690a686ec7db1fbf7c029976c940d1d1de9ca8400d9437da
SSDEEP

192:CaT2oLJTOJPkoBMJ7FFmqtugcj0RWm/McwhnrXF9dE4srRgCiegqjNhk:KiJqxzMJRFltB0hhnDd/3erk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0cb5dd8a660f268f61714120bbf3ae08_JaffaCakes118

Files

0cb5dd8a660f268f61714120bbf3ae08_JaffaCakes118
.dll windows:4 windows x86 arch:x86

9b06eec39719a697cc57aa1571d8aa24

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapAlloc
GetProcessHeap
VirtualProtect
CloseHandle
CompareStringA
IsBadReadPtr
LoadLibraryA
GetModuleHandleA
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetProcAddress
OpenProcess
lstrlenA
WideCharToMultiByte
GetPrivateProfileStringA
GetCurrentProcess
CreateThread
Sleep
FreeLibrary
GetModuleFileNameA

user32

wsprintfA
GetWindowThreadProcessId
FindWindowA
SetTimer
KillTimer
TranslateMessage
DispatchMessageA
GetMessageA

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

wininet

InternetCloseHandle
InternetReadFile
InternetOpenUrlA
InternetOpenA

msvcrt

_except_handler3
strrchr
strstr

Sections

.text
Size: 8KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 762B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ