39d5e6a1e45d5bb428d0f49906646647_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

39d5e6a1e45d5bb428d0f49906646647_JaffaCakes118
Size

11KB
MD5

39d5e6a1e45d5bb428d0f49906646647
SHA1

8d4ce9c8187aa6778b9bac77a8a05300d5de32f6
SHA256

c7d07f8cff892cf78e73fd35b369ff235303b89eaf78529d4170d6a28a01ec89
SHA512

9dc7049befa0f950bbd69dd169057512073dd63aaedb5206a677473326f28d622360069fd0b5e657b8ce9df5e9bac3afef9da85be1d2d712547009083557e1a4
SSDEEP

192:2m9XaaKJ1YEFYx6JcynorQXk/yz79XKkn:pVaageEax6Jcyer/y/VKw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
39d5e6a1e45d5bb428d0f49906646647_JaffaCakes118

Files

39d5e6a1e45d5bb428d0f49906646647_JaffaCakes118
.dll windows:4 windows x86 arch:x86

5d92fe1509f57bbf2ce6f80c95b7ca86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ReadProcessMemory
GetCurrentProcess
GetModuleFileNameA
GlobalFree
GlobalLock
VirtualProtectEx
GetModuleHandleA
GetComputerNameA
CreateThread
IsBadReadPtr
WriteProcessMemory
GlobalAlloc
VirtualAlloc

user32

UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
wsprintfA

wininet

InternetOpenUrlA
InternetOpenA
InternetCloseHandle

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sdata
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 354B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ