16e071b8512091939185c0858e0239b2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

16e071b8512091939185c0858e0239b2_JaffaCakes118
Size

70KB
MD5

16e071b8512091939185c0858e0239b2
SHA1

e14f6e15d054a44bda15cc467eed1c45dd24cf2d
SHA256

a0ca96e17d09ba5ee0ae836fa5b67986e4f1e965578b38db47921aaefa6cd218
SHA512

0b30b6289460e3cd3032acb9dd10a6180b177ffed92c8907e482ec8b7da3644d78dcb81130a58036f82a26c749de1bf0d4e6d6a530424ed1c304da7f5c4a1241
SSDEEP

1536:SCxA3pkTFSDgUamC64HdtJfbIAqpTfO5Wem2/U6:SCxA3pkTF65aJfbIAuTfKM6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16e071b8512091939185c0858e0239b2_JaffaCakes118

Files

16e071b8512091939185c0858e0239b2_JaffaCakes118
.dll windows:4 windows x86 arch:x86

2393977dd846e1b2edecf142184771a7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\BUILD_AREA\jdk6\control\build\windows-i586\tmp\sun\npt\obj\npt.pdb

Imports

msvcr71

atoi
malloc
abort
_adjust_fdiv
__CppXcptFilter
_except_handler3
__dllonexit
_onexit
free
calloc
_iob
fprintf
exit
_initterm
strcmp
_strdup

kernel32

WideCharToMultiByte
MultiByteToWideChar
GetUserDefaultLCID
GetLocaleInfoA
GetACP
DisableThreadLibraryCalls

Exports

Exports

nptInitialize
nptTerminate

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 344B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 62KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE