35353c0ef2a2bc5872078c29acdc3ba8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

35353c0ef2a2bc5872078c29acdc3ba8_JaffaCakes118
Size

6KB
MD5

35353c0ef2a2bc5872078c29acdc3ba8
SHA1

1c77391e96e0b41a4f846be6ea3bcd28602d3e93
SHA256

a591b1bfcfbf8a6c247d33f1b5d57aee67e8d98a3747fd5c8f96e974e5be7253
SHA512

dfdec7ec21ade8d011fca85d4b2df4d66c9dccfc04af145e91ce9f31e42ddeb838d5bbccb36389a99866c26b4ab9c939c499749475072321b8db904b0dcb1003
SSDEEP

96:K0dOyIvzcpUsu25R3uYg/7i4z2KEafL1S/zFbB:KzyozcpD15MYUOw2KL8bB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
35353c0ef2a2bc5872078c29acdc3ba8_JaffaCakes118

Files

35353c0ef2a2bc5872078c29acdc3ba8_JaffaCakes118
.dll windows:4 windows x86 arch:x86

df5c85ce7158ce273165a62ba7f11498

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalUnlock
GlobalLock
GlobalAlloc
VirtualProtectEx
GlobalFree
GetPrivateProfileStringA
ReadProcessMemory
Sleep
GetModuleFileNameA
CreateThread
GetCurrentProcess
IsBadReadPtr

user32

CallNextHookEx
SetWindowsHookExA

wininet

InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA

msvcrt

strlen
_adjust_fdiv
malloc
_initterm
free
strrchr
sprintf
strcat
_stricmp
??3@YAXPAX@Z
memcpy
strcpy

Exports

Exports

fx

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 957B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sdt
Size: 512B - Virtual size: 269B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 454B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ