40a193550820fdfa4ab89cdec9db888d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

40a193550820fdfa4ab89cdec9db888d_JaffaCakes118
Size

86KB
MD5

40a193550820fdfa4ab89cdec9db888d
SHA1

32534f5ae85c3c4d2cfa56b1a4b679d771024bde
SHA256

fc451ec217ff36297fb4c5b816863fe67bebce77e918bdc42258bc3f635e56fe
SHA512

db42724eea3a5c5b93cba5321f5df31cf5c63a54af0f8a71561b132611ca16c2c70647fe1d87524a6e72a822ef4742150ff6fb73646ef0e629ef2ced23933083
SSDEEP

1536:VlFGuk32rkLP29cThLPe37ziFQToEUl5HL18:cF3xLyuhTe37ziWTojlB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40a193550820fdfa4ab89cdec9db888d_JaffaCakes118

Files

40a193550820fdfa4ab89cdec9db888d_JaffaCakes118
.dll windows:4 windows x86 arch:x86

4337a5c15a92fbf3bdf01348f2b563ab

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

deacrahpoitfier.pdb

Imports

kernel32

TerminateProcess
GetCurrentProcessId
GetTickCount
UnhandledExceptionFilter
CreateRemoteThread
GetModuleHandleA
GetModuleHandleW
CloseHandle
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetLastError
GetCurrentThreadId
OpenProcess
Sleep
GetProcAddress
GetSystemTimeAsFileTime
GetCurrentProcess

advapi32

AdjustTokenPrivileges
OpenProcessToken
IsValidSid

Exports

Exports

osrxvl

Sections

.text
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ