396869b8ce49ef8a3052cfdca14d61f8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

396869b8ce49ef8a3052cfdca14d61f8_JaffaCakes118
Size

10KB
MD5

396869b8ce49ef8a3052cfdca14d61f8
SHA1

6758e7c454798366bfb7816a49f8818798b2df8a
SHA256

cee1e2e90712bf4fb41e5d22070411d7bc8872cb7c022aef5bea687fadb4a7a9
SHA512

1e06404222911c48da02778da722c6d238adec4fa2af481fb274fa9918da4457accaf1be286ec7e5cf3a88fc1e7e490e44a7b130a84f3d4e4e17f194206b19fc
SSDEEP

96:NDDtUAbdzzMEJDnG06tbpw6AB6P1PRD9UlbP5vcT2xgrBcBiUl2rz/8diX+nkKof:NDDFBzrJl6B9ku1FOuBM3e4G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
396869b8ce49ef8a3052cfdca14d61f8_JaffaCakes118

Files

396869b8ce49ef8a3052cfdca14d61f8_JaffaCakes118
.dll windows:4 windows x86 arch:x86

d9897786bb81b8660a6c9c9bfa5a0132

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

IsDebuggerPresent
Sleep
CloseHandle
CopyFileA
CreateFileA
CreateThread
GetEnvironmentVariableA
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
LoadLibraryA
MoveFileA
ReadFile
VirtualAlloc
WriteFile
lstrcmpA
lstrcpyA
lstrlenA

Exports

Exports

error_handler

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 585B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 810B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ