25ff8d9e6746994f39787bceecdeef44_JaffaCakes118 | Triage

Sharing

General

Target

25ff8d9e6746994f39787bceecdeef44_JaffaCakes118
Size

28KB
MD5

25ff8d9e6746994f39787bceecdeef44
SHA1

aaf924efe2dd95cd21a229dc867ac91b5ecd78dd
SHA256

38f51aa1afc6a4280e8e9d3a5399808047729eb1e1d4b180b5632847f775b73d
SHA512

e0ce5751ddfd74102ad25adea7db9d780e069de3ba777379d412d0e619072904150d39608cc6f8b7b251cb11b9d0d44bd8e8df5d057383b1bb308e74e11b1f96
SSDEEP

192:kZd73dPHhnJy3FKvZA4topONUkTM2yBbSx78WXkEgbVW4Gu9lplsigZagQy:8jPhJy4ZqATlyBOjcs4GSpGigZ5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
25ff8d9e6746994f39787bceecdeef44_JaffaCakes118

Files

25ff8d9e6746994f39787bceecdeef44_JaffaCakes118
.dll windows:4 windows x86 arch:x86

8d3b1e7e15b78178be54d722f8efaaba

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

FindWindowA
GetWindowTextA

msvcrt

_adjust_fdiv
malloc
_initterm
free
strlen
atoi
memcpy
strstr
??3@YAXPAX@Z
??2@YAPAXI@Z
memset
_strlwr

kernel32

VirtualProtectEx
TerminateProcess
CreateThread
OutputDebugStringA
GetModuleHandleA
Sleep
GetTempPathA
CopyFileA
GetModuleFileNameA
LoadLibraryA
GetProcAddress
lstrlenA
lstrcatA
GetCurrentProcess
GetCurrentProcessId
ReadProcessMemory
lstrcpyA

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 846B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 752B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ