30edb47413178cf147dec31def51fc4c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

30edb47413178cf147dec31def51fc4c_JaffaCakes118
Size

13KB
MD5

30edb47413178cf147dec31def51fc4c
SHA1

76b6330f42c720fdfc4ae1aa0d8b064ea13e40a1
SHA256

f6a1c917c750777410ede2c5fdb1e39bfe42317e61f3d10da5875d540fa9c7da
SHA512

aadda5f3dd15a851dd4f4ce93822be7cba0a533f2aabb0e324d8eef15df9b2f343d5b185f30a233249775cb1a17af72a570ea0e3b700e016726d878b4931b2e7
SSDEEP

384:ecEfCBWJK97TMaBxqEmus/+yGWi1N32AllJiHLqk:ecEfwf/qJn21N3X+HLqk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
30edb47413178cf147dec31def51fc4c_JaffaCakes118

Files

30edb47413178cf147dec31def51fc4c_JaffaCakes118
.dll windows:5 windows x86 arch:x86

8bad5c2447491e26190e836fbdf08091

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ExitProcess
CreateFileA
GetFileSize
SetFilePointer
HeapAlloc
HeapFree
WaitForSingleObject
GetTickCount
GetProcessHeap
GetSystemTimeAsFileTime
WriteFile
Sleep
CreateProcessA
ReadFile
FindFirstFileA
GetLastError
FindClose
MoveFileA
GetModuleFileNameA
GetModuleHandleA
VirtualProtect
CloseHandle
GetVersion
DeleteFileA
CreateThread

user32

GetWindowThreadProcessId
EnumChildWindows
GetDlgItem
GetWindowLongA
EnumWindows
CloseDesktop
GetClientRect
FindWindowExA
CreateDesktopA
GetClassNameA

Exports

Exports

_Auto@0

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ