40ee9232c32eb981c175fc1244d88308_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

40ee9232c32eb981c175fc1244d88308_JaffaCakes118
Size

88KB
MD5

40ee9232c32eb981c175fc1244d88308
SHA1

564482c811f7b817397f1adfbc197f1047d93a61
SHA256

321e77d73b6af3c328ca0d4fb0fc263e5c89e273daccafb290141ff8bf7c8ebd
SHA512

e1f9d3b2b1c032d6d805c5e454a25401e745946c8a63a26f53882134b3e50965d1dac49615bebfed4856d7895453d12c1a71ea3f7c9dde803d449ea996e81f26
SSDEEP

1536:vxGWCvtA0/QUpjqZInrpMZAvAFxuE5nItc2M/bISou:mVFjdqqpeF0ExGM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40ee9232c32eb981c175fc1244d88308_JaffaCakes118

Files

40ee9232c32eb981c175fc1244d88308_JaffaCakes118
.dll windows:4 windows x86 arch:x86

9afb596592fc50a892bfd44e40e429bd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
ResumeThread
OutputDebugStringA
GetConsoleScreenBufferInfo
ConsoleMenuControl
FreeEnvironmentStringsA
GetConsoleScreenBufferInfo
LoadResource
InterlockedCompareExchange
GlobalUnfix
GetCommandLineA
GetStartupInfoA
ExitProcess

ntdll

RtlZeroHeap
vsprintf
NtLockFile
strstr
NtReplaceKey

Sections

.edata
Size: 4KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.adata
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Weijunli
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ