417a66af6d8ac524736fe8d2a1215e7d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

417a66af6d8ac524736fe8d2a1215e7d_JaffaCakes118
Size

24KB
MD5

417a66af6d8ac524736fe8d2a1215e7d
SHA1

6285e8393018038209a4778726001aa835b7a228
SHA256

93ba3e1188c6c298ec3dcd400baf67286cb8d268de3232321301e2a088a433f2
SHA512

c529b0b026f5ba314168aa0592d67c51e4896f6e15ded4c1753d2005e36adb8cade196731eda19a1cdc8739c372e0f9c6cdf7ad7fd3511cb132e33c2bc8cd54b
SSDEEP

192:HN9KXhs//1IShPKbOpbeQBnhfOFSqc1tvCpct5UbR7:PKXhs//1IShPUwvtoFSqc1tvCpct507

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
417a66af6d8ac524736fe8d2a1215e7d_JaffaCakes118

Files

417a66af6d8ac524736fe8d2a1215e7d_JaffaCakes118
.dll windows:4 windows x86 arch:x86

a209ec57d42a9b45fe11dc296daa9563

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetWindowThreadProcessId
GetClassNameA
GetWindowTextA
EnumWindows

msvcrt

_initterm
free
_adjust_fdiv
_strlwr
strchr
atoi
memcpy
strcmp
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
_itoa
malloc

kernel32

Sleep
CreateThread
ExitProcess
lstrcmpA
lstrlenA
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1010B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 626B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ