3bd766612d39f33cfe3a8542269f6523_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3bd766612d39f33cfe3a8542269f6523_JaffaCakes118
Size

24KB
MD5

3bd766612d39f33cfe3a8542269f6523
SHA1

7b08740b1750ae295597dad452c7abd78e995973
SHA256

df8e82e11631bd5ee79f133a1b4ec1077d1627a662e584c643a61464a62d3f05
SHA512

a80408446abfacf6a0f6de3c95855addb8be8c180d6fb1a401cb6cbe018e7a257e3943fe3129bb02b3ea7c4830cd532530ec9cb272d1c1690fbc9f6e9d7ce3d3
SSDEEP

96:KNP4pxV8vXl+wy2N8VWoM9Ol62v5o2dWwWg:FX+vXl+wf+Wz/2o8Wzg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3bd766612d39f33cfe3a8542269f6523_JaffaCakes118

Files

3bd766612d39f33cfe3a8542269f6523_JaffaCakes118
.dll windows:4 windows x86 arch:x86

0ebaf228e99d21c76817bce162af8a11

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetSystemDirectoryA
ExitThread
HeapFree
GetProcAddress
LoadLibraryA
GetLastError
CreateMutexA
lstrcmpiA
GetModuleFileNameA
HeapAlloc
GetProcessHeap
Sleep
TerminateThread
CreateThread
DisableThreadLibraryCalls

shlwapi

SHGetValueA
StrRChrA
PathCombineA

imagehlp

ImageLoad
ImageUnload

Exports

Exports

CreateProcessNotify

Sections

.text
Size: 4KB - Virtual size: 553B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 705B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ