2cf5bef3df40c3c774089e041024c32b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2cf5bef3df40c3c774089e041024c32b_JaffaCakes118
Size

308KB
MD5

2cf5bef3df40c3c774089e041024c32b
SHA1

8599b88fcf8fde5ac35dfece07e96f14e7fb9aaf
SHA256

c401fb36d106158051742869a28499a418916c85dc80822f23eb12024d7a358a
SHA512

44c9768a6138e7cb8864477bc270b80cf84bcd08f48829b43f1112e66e2623914d49819d238bebfc587674a2451b43a02ccaafafdbdbc2314da8d72c9020ca15
SSDEEP

6144:02iW0+TyzQaPBrBZMzfX0SUQ37V3iVe1gD/WsbUH22bykqd+I4xDxyY:0GByNPhkDXRUaFiA1gjWOW2dktvxDxyY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2cf5bef3df40c3c774089e041024c32b_JaffaCakes118

Files

2cf5bef3df40c3c774089e041024c32b_JaffaCakes118
.dll windows:4 windows x86 arch:x86

6555a7a64155fe0719e54ea314051ec9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualFree
ExitProcess
GetProcAddress
VirtualProtect
VirtualAlloc
LoadLibraryA

user32

GetCursorPos

gdi32

LineTo
CreateCompatibleDC

Sections

.text
Size: 231KB - Virtual size: 420KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.aspack
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ