1c8cdf4ae394875f8276393208c8bfc8_JaffaCakes118 | Triage

Sharing

General

Target

1c8cdf4ae394875f8276393208c8bfc8_JaffaCakes118
Size

5KB
MD5

1c8cdf4ae394875f8276393208c8bfc8
SHA1

d25a77fa4b2fdbcc091a4640075f113dfdecb128
SHA256

96569e7ca939c82977466a5f5785f68816e031289c34127412aaa59c08c2caad
SHA512

2b7fe29243f290851832dc6f505cb48d90a9ccf4c20eba183936f1a3612106a98aee0a068b2b901cd404180e007bc5c02bc4bfaac08ace2aa095a279afe9c6f4
SSDEEP

48:Cr/I2/LT2OfIkQl/7MTjfPK6bDS1u2It7KuDXdS6uDX3TIOVanfQTc0L+9+dc:EW7/7mjdbuc2S7hTMRT31afobW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1c8cdf4ae394875f8276393208c8bfc8_JaffaCakes118

Files

1c8cdf4ae394875f8276393208c8bfc8_JaffaCakes118
.dll windows:4 windows x86 arch:x86

b5309aad7614edb67a72fb2bc24ced1f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleFileNameA
GetCurrentProcess
GlobalFree
ReadProcessMemory
GlobalLock
GlobalAlloc
CreateThread
GetPrivateProfileStringA
Sleep
WriteProcessMemory

user32

CallNextHookEx
SetWindowsHookExA

wininet

InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA

msvcrt

_adjust_fdiv
malloc
_initterm
free
_stricmp
strrchr
strcpy
sprintf
??2@YAPAXI@Z
strlen
??3@YAXPAX@Z

Exports

Exports

fx

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 893B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sdt
Size: 512B - Virtual size: 269B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 350B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ