1a5f9fc4d85dde76e89825d85605679d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1a5f9fc4d85dde76e89825d85605679d_JaffaCakes118
Size

24KB
MD5

1a5f9fc4d85dde76e89825d85605679d
SHA1

c43aecc51fc27a71fb9360ea04f64d7a2e69e273
SHA256

95f586d853498bb071d1daa30bacdd3ff54dd7fcbc05c7287aa0be3e5fe72bb8
SHA512

72115f888ceb6677f9d11f304ca694ee755d648924fdd08e9e8e0d7cda222078568a050e7d4c167730980b2abbda271302ae585c6f2db8b5bf51861435999c18
SSDEEP

96:ZnWpeOVUcRrL3Cwskfm1DCI0Uav9hue3axU49Ew6G:ZnDOhRrLXoWU29ke/wd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a5f9fc4d85dde76e89825d85605679d_JaffaCakes118

Files

1a5f9fc4d85dde76e89825d85605679d_JaffaCakes118
.dll windows:4 windows x86 arch:x86

dff5217af9dadc9df25d9b6944482e30

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord4129
ord540
ord823
ord1168
ord2818
ord861
ord1253
ord342
ord941
ord858
ord5710
ord5683
ord5572
ord2915
ord800
ord537
ord1182

msvcrt

_initterm
_adjust_fdiv
_onexit
__dllonexit
wcscpy
_mbsicmp
malloc
free
__CxxFrameHandler

kernel32

GetModuleFileNameA
GetModuleHandleA
FlushInstructionCache
WriteProcessMemory
ReadProcessMemory
GetCurrentProcess
VirtualProtect
GetProcAddress

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 883B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 776B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 550B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ