0ec39feeddb51aaace14fbbecf42b023_JaffaCakes118 | Triage

Sharing

General

Target

0ec39feeddb51aaace14fbbecf42b023_JaffaCakes118
Size

24KB
MD5

0ec39feeddb51aaace14fbbecf42b023
SHA1

210a956f0f00fd5ddd8c77a20592377850cd232d
SHA256

c5817c0f99c91106f82647402f9e8a7d8a47c17740f05125a48d4202ca3d5edf
SHA512

f5e38cb503ab3192a2e310c0eb90665999b42a041dbaef029d23b58d29c6c5f116243b3b591ca2862717fa4da59e79a8f8938ad1e23885dbf6cdb9714be67c5d
SSDEEP

96:TGoIIyDA4o56PEJu1Uoo5/y54zLVOnmSCjp+Ss2BP+ke4UPvC6yR1:XIIyDAT56s6Uoeq5sREmSWpVP64Uy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ec39feeddb51aaace14fbbecf42b023_JaffaCakes118

Files

0ec39feeddb51aaace14fbbecf42b023_JaffaCakes118
.dll windows:4 windows x86 arch:x86

c87cad7df5903fd37c32be6790c882e9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LeaveCriticalSection
EnterCriticalSection
GetProcAddress
GetModuleHandleA
lstrcatA
lstrcpyA
GetFileAttributesA
lstrlenA
lstrcpynA
LoadLibraryA
lstrcmpiA
GetModuleFileNameA
FreeLibrary
GetVersionExA
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
DebugBreak
DeleteCriticalSection
GetDriveTypeA
InitializeCriticalSection

user32

CallNextHookEx

advapi32

RegFlushKey
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegDeleteValueA
RegSetValueExA

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 381B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 316B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ