42a894344c7b76e7fa751cf2e28d3980_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

42a894344c7b76e7fa751cf2e28d3980_JaffaCakes118
Size

48KB
MD5

42a894344c7b76e7fa751cf2e28d3980
SHA1

76a027b23e390f2364779734c8604e17fe1c8c31
SHA256

eac79172436ef60c279daf5101c98741bf80a0a4eb0178bacaf95413bddfe317
SHA512

9f683376817b6e3be2f765f3d9fd1b4dfbfabe0363dffd6deef4723f1de05875c64cb9145d758a142ffe48305f636b20d94287e0ce4821600e2b594b4eac2b7b
SSDEEP

768:NYqlGqTZM49EipJ5lbYUiwnQdFInszsWh1dUlT+8jZgKf0X:NYqlvHEi5CULnQdGszsjzGKf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
42a894344c7b76e7fa751cf2e28d3980_JaffaCakes118

Files

42a894344c7b76e7fa751cf2e28d3980_JaffaCakes118
.dll windows:4 windows x86 arch:x86

4eaa6a39019fdde8ba1831059dc3318b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

naeinithee.pdb

Imports

kernel32

FreeLibrary
LoadLibraryW
InterlockedIncrement
InterlockedDecrement
lstrcpyW
CloseHandle
MulDiv
SetEvent
MultiByteToWideChar
GetCurrentThreadId
GetProcAddress
GlobalAlloc
LoadLibraryA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
CreateEventW
GetTickCount
GetTempPathW
GetTempFileNameW
CopyFileW
ReadFile
GetFileAttributesW
CreateFileW
WriteFile
GlobalFree
DeleteFileW
ResetEvent
GetLocalTime
lstrcatW
GetUserDefaultLCID
GetCurrentDirectoryW
FormatMessageW
LocalFree
lstrcmpW
GetModuleHandleA
QueryPerformanceCounter
lstrlenW

advapi32

IsValidSid

msvcrt

exit

Exports

Exports

rbuge

Sections

.text
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 498B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ