20e5962a7d42fe4e6915abce263a4f80_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

20e5962a7d42fe4e6915abce263a4f80_JaffaCakes118
Size

136KB
MD5

20e5962a7d42fe4e6915abce263a4f80
SHA1

3ab09e6aa0c6e790d3310c6fbd4d4fbb18bee42a
SHA256

3c1d6c893057e22be192ef5ba5d763673db817b51a446574717a615cd84d64d6
SHA512

3b0304cdb3900e4af36ed0ec6d2b1471b55dd1c4c51770910232f8868268c75991ac1675fbc0acb62c31da4ae8e176a0a8c9852dee998c5828ae38afa769df54
SSDEEP

3072:elXKcrWolL0y9LFCijJM33EVi9gdjxLBTKuZnBkVaZOY3d:yX7l/9LBjy3E0QjmYBEaEY3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20e5962a7d42fe4e6915abce263a4f80_JaffaCakes118

Files

20e5962a7d42fe4e6915abce263a4f80_JaffaCakes118
.dll windows:5 windows x86 arch:x86

0d6956b5994657752d64e508522b4950

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

X:\pWrpwWtyNifR\bpKzfgHsgcfja\qxfgpdcehlvXlg.pdb

Imports

user32

SetScrollPos
CopyRect
wsprintfA
CreateAcceleratorTableW
PostThreadMessageA
SetWindowRgn
LookupIconIdFromDirectory

shlwapi

StrFormatByteSize64A
StrRChrW

kernel32

AddAtomW
FindNextChangeNotification
CreatePipe
OpenEventA
RemoveDirectoryA
AreFileApisANSI

gdi32

OffsetRgn
GetROP2
GetDIBits
CombineRgn
CreateSolidBrush
CreatePenIndirect

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
isalpha
_amsg_exit
fread
_initterm
wcstod
_ismbblead
_XcptFilter
_exit
_cexit
__setusermatherr
__getmainargs

Exports

Exports

H99|U
?GeometryTranslate@@YGHPADK|U

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 112KB - Virtual size: 284KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE