3897cef6bc16cb7aa0ab97bc17de5651_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3897cef6bc16cb7aa0ab97bc17de5651_JaffaCakes118
Size

1.1MB
MD5

3897cef6bc16cb7aa0ab97bc17de5651
SHA1

9b4713be4196cc7a557875ace742082a4f067d32
SHA256

0575c9a8bbdc502c3dbdd2ea19d2158416535ab634ceb448a90c8abcbbcd510f
SHA512

0efaca29088c2416fa0ecc13a3b9b45bd51fbaef5e133579d9274a0b3b0e5d18c050b7cd8b398d9ee056e1d3effcd33f24be436947eee9166349a4f2945fd942
SSDEEP

12288:m8jVEC98OZkr0uZhsdc5OKP2LB9AkQhKM1jShuVFz:hSCWr0uZJcB9zMouVJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3897cef6bc16cb7aa0ab97bc17de5651_JaffaCakes118

Files

3897cef6bc16cb7aa0ab97bc17de5651_JaffaCakes118
.dll windows:4 windows x86 arch:x86

7a9964b6d087bd9321a37b0e0489abc6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\RYUJIN_Runtime\RyuJin\Runtime\Release\FMRSRC.pdb

Imports

mfc70u

ord985
ord705
ord317
ord703
ord972

msvcr70

__dllonexit
_except_handler3
?terminate@@YAXXZ
_adjust_fdiv
malloc
_initterm
free
__security_error_handler
_onexit

kernel32

GetProcAddress
LoadLibraryA
VirtualAlloc
GetVersionExW
ExitProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetACP

oleaut32

SysFreeString

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ