1c8b2dcd494b67d8000bbabe7c015fc0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1c8b2dcd494b67d8000bbabe7c015fc0_JaffaCakes118
Size

255KB
MD5

1c8b2dcd494b67d8000bbabe7c015fc0
SHA1

458069f3a862cb9cf7a361435241fcad452358eb
SHA256

180fd7e11d5afba828753d2fcfb85bc1404562b150f6a8b1add3ee40ce653272
SHA512

fa960c0986eaaf6b2f7a1a9e2baa8d85a459e849580181843e7adff58e7e72ea01190713e9bf9d9f968e2c89611002507e03e75dae3fb14cf95de3258e6a2636
SSDEEP

1536:hFPstyLekv7EAYOAZgpLQikKSB6kdj/WOh:17EAYoZQik38E

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1c8b2dcd494b67d8000bbabe7c015fc0_JaffaCakes118

Files

1c8b2dcd494b67d8000bbabe7c015fc0_JaffaCakes118
.dll windows:4 windows x86 arch:x86

1452231ad23eb215b63f035667d8a2e7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

AddAtomA
CreateThread
DisableThreadLibraryCalls
ExitProcess
FindAtomA
GetAtomNameA
GetModuleFileNameA
GetModuleHandleA
Sleep
VirtualProtect

msvcrt

__dllonexit
_errno
_iob
abort
fflush
fprintf
free
malloc
memcpy
strstr

user32

GetAsyncKeyState
MessageBoxA

Sections

.text
Size: 219KB - Virtual size: 218KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 368B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 752B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ