3f4f80d10c8a1e624623b6d2e5cde92e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3f4f80d10c8a1e624623b6d2e5cde92e_JaffaCakes118
Size

8KB
MD5

3f4f80d10c8a1e624623b6d2e5cde92e
SHA1

77ccd74eab56bc7c189403753f876aca878083b4
SHA256

ca3318f584ba57a05a8c1e3765ef52ad6d69255dff602290d279c9e4b86273c7
SHA512

061ed8257c3f70635e33d890835ca466965d7459928f220b2b29892f05bf68fda05763fb0fe7b0b22bd20d1760bd67afc2591600b6799c5a15e6a77d18922f5b
SSDEEP

192:eQqN69MiuVsTmbtxtYRPbpu8VxiTkeQAsOiqlMGxzIb06pdmAh:XqN6SiuVKC7YRPYCc4A8pb06pUs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3f4f80d10c8a1e624623b6d2e5cde92e_JaffaCakes118

Files

3f4f80d10c8a1e624623b6d2e5cde92e_JaffaCakes118
.dll windows:4 windows x86 arch:x86

54edd43b8cce2d147d868d979941e6b7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

ZwLoadDriver
RtlImageNtHeader
atol
RtlAdjustPrivilege
strchr
RtlInitUnicodeString
ZwFlushInstructionCache
ZwCreateEvent
mbstowcs
sprintf
_stricmp
_snprintf
memcpy
_chkstk

kernel32

CopyFileA
GetLastError
InterlockedExchange
GetProcAddress
LocalAlloc
CreateThread
GetTempPathA
WinExec
VirtualProtect
LoadLibraryExA
GetModuleHandleA
GetModuleFileNameA
LoadLibraryA
VirtualQuery
VirtualFree
VirtualAlloc
GetVersionExA
CreateFileA
GetLogicalDrives
WriteFile
Sleep
CreateDirectoryA
GetTempFileNameA
SetFileAttributesA
CloseHandle
MoveFileExA
FreeLibrary
GetTickCount
RaiseException

Sections

.text
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 160B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 378B - Virtual size: 544B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ