37a9f1456a9bd1323e9894935fd72baf_JaffaCakes118 | Triage

Sharing

General

Target

37a9f1456a9bd1323e9894935fd72baf_JaffaCakes118
Size

40KB
MD5

37a9f1456a9bd1323e9894935fd72baf
SHA1

2083668d8300eafaac3ad4bc25ced02ebb2a2c0b
SHA256

f2178528f9866a13998a039d0377447ca4501cb79263709e5ca0ba70031302c1
SHA512

9d0396680e0985db4437c2a85a510b8d121f9ad4394eb45f79a5f0fcd63a7b126afe0e8e4833d057ad8e0115c26eb1d15ac5a0640636b1cb264abdb4d8073748
SSDEEP

768:uGbg9Y64xFVAMvkKzq/hIyidJPyUo8pf/rL/IcJ7LOxx:uGkp4bOMv7q/hOdJPyU5pfTskOxx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
37a9f1456a9bd1323e9894935fd72baf_JaffaCakes118

Files

37a9f1456a9bd1323e9894935fd72baf_JaffaCakes118
.dll windows:5 windows x86 arch:x86

0796aa69a422b69c948951ab42ec906e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FreeResource
VirtualFree
GetModuleHandleA
FindResourceA
SizeofResource
LoadResource
AddAtomA
LockResource
FindAtomA
GetProcAddress
VirtualAlloc

user32

WindowFromDC
wvsprintfA
WindowFromPoint
UnloadKeyboardLayout
WaitForInputIdle
UnionRect
VkKeyScanExA
ValidateRect
WinHelpA

advapi32

RegConnectRegistryA
CryptSetProvParam
CryptAcquireContextA
CryptEncrypt
RegOpenKeyExA
RegQueryInfoKeyA
RegUnLoadKeyA
CryptDecrypt
RegLoadKeyA

Exports

Exports

mrexcahosc
optvcwlkmr

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 958B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ