3a6d95c9d47d6884a7302134b59d40af_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3a6d95c9d47d6884a7302134b59d40af_JaffaCakes118
Size

438KB
MD5

3a6d95c9d47d6884a7302134b59d40af
SHA1

48a5572b78c0a9d887a5411d1a7fc0b95fb0956b
SHA256

16b4076a288492cd5fa1fc7e92866ed0f32067c336f347c404731ea430fe13be
SHA512

e1d802eb962629c32978bce894f5bc5d6b03100691bc072c3a9954ce811bb54bc78a4b6d5898c4a2aa34069a7ce708b328d60684aaf33c37e7e53bf6d90d67c8
SSDEEP

6144:2JSydC+46dDxLh3LRwRUCRdp24a5X2QsiriPTHvKiGcvlWSXfLd7hpom+rtVxy:2Qyo+vdDVhbSRVe4WRVri7w1sxHov1y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3a6d95c9d47d6884a7302134b59d40af_JaffaCakes118

Files

3a6d95c9d47d6884a7302134b59d40af_JaffaCakes118
.dll windows:4 windows x86 arch:x86

0479c26ca6b4aaafa533fe4c4c8551c5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

pdb.pdb

Imports

kernel32

Beep
OpenProcess
GetCurrentProcessId
lstrcmpA
MulDiv
LocalFree
Sleep
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
TerminateThread
WaitForSingleObject
CreateThread
CloseHandle
GetLocaleInfoA
LeaveCriticalSection
EnterCriticalSection
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
HeapAlloc
GetProcessHeap
HeapFree
ReadConsoleInputA
HeapValidate

msvcrt

memset

Exports

Exports

fsxpcc

Sections

.text
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 380KB - Virtual size: 379KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ