3e05809d7508de4ea1f6054170526951_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3e05809d7508de4ea1f6054170526951_JaffaCakes118
Size

4KB
MD5

3e05809d7508de4ea1f6054170526951
SHA1

cc8ba8ab73742910ec72bdd9f90b4acca1861603
SHA256

d8d4bb4ad81142d7a8e38abb6676cc4fac43984745b75d357c2eb1ad12c3cede
SHA512

a817068409bade583d3ab2177d8dfd591d52df5642f03ae8b2806fcc567df483463b2cc9b8b5d95d40d311e91d23fdf8c21b85bd55cef1fff7f9bd3e0f5f79ad

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e05809d7508de4ea1f6054170526951_JaffaCakes118

Files

3e05809d7508de4ea1f6054170526951_JaffaCakes118
.dll windows:1 windows x86 arch:x86

b03c338b7bd69b7ee9585fd8450a8f8c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CreateFileA
ExpandEnvironmentStringsA
GetFileSize
GetProcAddress
GlobalAlloc
GlobalFree
LoadLibraryA
MoveFileA
MoveFileExA
MultiByteToWideChar
ReadFile
SetCurrentDirectoryA
SetFilePointer
SetUnhandledExceptionFilter
Sleep
WinExec
WriteFile

user32

FindWindowA

imagehlp

CheckSumMappedFile
ImageLoad
ImageUnload

ntdll

ZwQuerySystemInformation

sfc

ord5

Exports

Exports

_antir
_closeSFC
_patchfile

Sections

.4s
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE