0effe52082bf37723e2321f8b8eed0c0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0effe52082bf37723e2321f8b8eed0c0_JaffaCakes118
Size

129KB
MD5

0effe52082bf37723e2321f8b8eed0c0
SHA1

eb492829f8c794e2624594f40e5e15486c240102
SHA256

b43314394c8f254c679fbef4694fd8a8d790f82d92cc3e139f3185238c6f36b8
SHA512

f481ac894af5a70de8c628517ee53012b9a89832a28c4d0bf64ac896243bd0adc1d0ebc1c9f0de95d3851a465363a8b2012cc9da68fec07406eca0a7e4a4fd8d
SSDEEP

3072:id66bwcuOSVwbMw4/MNZNn+lVqfW0tQ9h6PCqztx:O66bwcuIbd3XNn+lVqfttmh66qz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0effe52082bf37723e2321f8b8eed0c0_JaffaCakes118

Files

0effe52082bf37723e2321f8b8eed0c0_JaffaCakes118
.dll windows:4 windows x86 arch:x86

3737e55029be44d76ada9789d7dfb55f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FreeEnvironmentStringsW
GetLocaleInfoA
GetSystemInfo
GetVersion
HeapAlloc
HeapCreate
HeapFree
LoadLibraryA
LocalAlloc
QueryPerformanceCounter
SetErrorMode
lstrcmpiA
lstrcpynA

msvcrt

strpbrk
__p__fmode
_stricmp
exit
fprintf
free
time
swscanf
wcslen
isdigit
fwprintf

user32

GetWindowLongA
RegisterWindowMessageA
SetCapture
SetUserObjectSecurity
GetKeyState

oleaut32

SafeArrayAccessData
OleLoadPicturePath
SafeArrayDestroy
SysReAllocString
SysStringLen
VarBstrCat

shlwapi

PathAppendA
PathGetCharTypeA
PathGetDriveNumberA
SHDeleteValueA
SHOpenRegStreamA
StrSpnA
StrToIntA
StrStrA

Exports

Exports

D3DBreakVBLock

Sections

.text
Size: 64KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ