398b3d65936d032d2952c8ceb5748135_JaffaCakes118 | Triage

Sharing

General

Target

398b3d65936d032d2952c8ceb5748135_JaffaCakes118
Size

169KB
MD5

398b3d65936d032d2952c8ceb5748135
SHA1

b85177c55a6ef25bdb75caf6100a4615713fe115
SHA256

c92271b83b110ca35b6b378a87c3ef4676996480e0ba2d3d4cd4d054627ff320
SHA512

d19a1b04700f7d4159418528a7e34069f8aaad7ffd4a6ec9167999a787a3e7236b1f8ab86b82fe89adfe592b71f613736b3da1cbc89ef4624577fd39a3f1b66f
SSDEEP

3072:KpoEzBPEb+k3OycKHCx8qAIi7p61jY2aV1DFGAJ7W8VeUh:HEzBsb+sBCvAIC81Hy8Ag

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
398b3d65936d032d2952c8ceb5748135_JaffaCakes118

Files

398b3d65936d032d2952c8ceb5748135_JaffaCakes118
.dll windows:4 windows x86 arch:x86

5acafc82443bd14950cbf31e3d66a4ed

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualAllocEx
LoadLibraryA
GetProcessHeap
LoadLibraryExA
RaiseException
VirtualAlloc
ExitProcess

gdi32

GetBkColor
SaveDC
CreatePenIndirect
GetBkMode

user32

TranslateMessage
UnhookWindowsHookEx
IsMenu
UnregisterClassA
GetMenu
CharLowerA
WaitMessage

comdlg32

FindTextA
GetSaveFileNameA
ChooseColorA

Exports

Exports

_jhY6e2
WoyxpMfWUsqjL
_Amy5Cmu7CZfR1K@4
_NwuBK9wgmte@8
9wrFWUKDg
_qO_Y4dfzz6Ccj2
_WIj8jLm_wlxovJ@20
_2IemZGq8wuQ@20
_CzAvM8IdKUHkxA@12
A_kLE1tCY4yN6
_htVnEXZpyZwsp
Jdq7pX3bUJ
hzy1jEP@24
6AuFipDYIKA@12
_Bwn2BjGDGR
_KE3GQXlLGa
GiWy0hxbO
_N4qDKOg

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 153KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ