18f7275097820a6dcd320e24b01f4e83_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

18f7275097820a6dcd320e24b01f4e83_JaffaCakes118
Size

152KB
MD5

18f7275097820a6dcd320e24b01f4e83
SHA1

58eacdb05ce50bc257936c2273f2a6546c1015e7
SHA256

dd13762b47cf95119b8c19e0d4fb70b1ff85e5124c9b2708d5e0331e7441f2c1
SHA512

840dbff8a62136bbc112bd8ad73838ce0ff1549654b0ba0aba791b4f7d26a0714d38a1ea2d36e8b50d89282451b0856407f58a30ca1e997a3f4ed34c049b7154
SSDEEP

3072:9uZnBkeaZ9Y3dqFCi4Jr33EVo9gd+gLBTzeC1ElpvqyJJ:9YBha7Y34B4p3EGQ+2El99

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
18f7275097820a6dcd320e24b01f4e83_JaffaCakes118

Files

18f7275097820a6dcd320e24b01f4e83_JaffaCakes118
.dll windows:5 windows x86 arch:x86

2db7dbe835f5b7101a80e1288df85a33

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\diicfPcgpns\bYWavyzqZa\QbmqGGPrBNgtE\WhFlbtpidDc.pdb

Imports

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_amsg_exit
_initterm
_ismbblead
_XcptFilter
islower
_exit
_cexit
__setusermatherr
__getmainargs

kernel32

CreateWaitableTimerW
GetModuleHandleA
LoadLibraryExW
HeapWalk
EscapeCommFunction
SetEvent
GlobalLock

gdi32

GetNearestPaletteIndex
EnumFontsW
ExcludeClipRect
GetTextColor
GetMapMode

user32

SetWindowPlacement
wsprintfA
CharUpperW
GetKeyState
DestroyAcceleratorTable
GetFocus
DrawAnimatedRects
IsCharAlphaW

shlwapi

StrFormatByteSize64A
StrRChrW

Exports

Exports

H99|U
?FutureProspect@@YGHPADK|U

Sections

.text
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE