40d71db835a52805f7527115b3b3c3d3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

40d71db835a52805f7527115b3b3c3d3_JaffaCakes118
Size

119KB
MD5

40d71db835a52805f7527115b3b3c3d3
SHA1

765b50df0d39d2e693ba88308f6e0a3c03aebc03
SHA256

53ec7601e3877048e40ffd6edbdaf5e7adab43b1d1f99bd725680301fb04f8e2
SHA512

7058eb8047ddb58db3370b9f5d7d403c7806a7a0e85e7b6ce1bdb7b0552a65341391b6c2c8ac538ce0cd445241aecde19fc92c857f61498d5e2106a1f482645c
SSDEEP

3072:a8Fokz/BhW/8j5Jz2tbzbMWKMCpQg3TH:xGkz/B8/kJqtbQV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40d71db835a52805f7527115b3b3c3d3_JaffaCakes118

Files

40d71db835a52805f7527115b3b3c3d3_JaffaCakes118
.dll windows:4 windows x86 arch:x86

d69e0b24fad31bffab574a11e0fbd276

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Users\Ryan-NB\Documents\Visual Studio 2005\Projects\ResourceDll\release\ResourceDll.pdb

Imports

msvcr80

_lock
__dllonexit
_except_handler4_common
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_onexit
_encode_pointer

kernel32

GetProcAddress
LoadLibraryA
VirtualAlloc
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 868B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 114KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 372B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ