392d77fa0627db36566ff86dcc1032ed_JaffaCakes118 | Triage

Sharing

General

Target

392d77fa0627db36566ff86dcc1032ed_JaffaCakes118
Size

10KB
MD5

392d77fa0627db36566ff86dcc1032ed
SHA1

c30d1fea54993ee5d675dabeab4df5d90759605f
SHA256

03bd693695ad6a8776333c7f1d62f66a841b6eaf86f32970d07afca0e9b5910a
SHA512

8f56edb812cdadc96186e5cc5b0eb7a694146e377ff61a51796970d605ea04b0daf1245559b7c9f70182d8045dae095e36cc31f3b62fb1dacc03e520e045a1eb
SSDEEP

192:j6ugjOSp/QtxDJYqkoo7FVQ43tqpO/VGsrY1Y12MBLMQdjgNpNk2Ski1x:8KSp/QtxDWq6RVhtJgmY1i2MBL6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
392d77fa0627db36566ff86dcc1032ed_JaffaCakes118

Files

392d77fa0627db36566ff86dcc1032ed_JaffaCakes118
.dll windows:4 windows x86 arch:x86

4f59a1e37a3ab8db3610d4448a0a616e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapAlloc
GetProcessHeap
VirtualProtect
CloseHandle
CompareStringA
IsBadReadPtr
LoadLibraryA
GetModuleHandleA
GetModuleFileNameA
GlobalAlloc
Process32Next
Process32First
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
GetProcAddress
lstrlenA
GlobalFree
GetCurrentProcessId
GetTickCount
CreateThread
GetPrivateProfileStringA
ExitProcess
Thread32Next
TerminateThread
Thread32First
GetCurrentProcess
Sleep

user32

wsprintfA
CallNextHookEx
TranslateMessage
DispatchMessageA
GetMessageA
SetWindowsHookExA

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

wininet

InternetCloseHandle
InternetReadFile
InternetOpenUrlA
InternetOpenA

Sections

.text
Size: 8KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 780B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ