5d68464e9b061d82c683b0494ee903b8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5d68464e9b061d82c683b0494ee903b8_JaffaCakes118
Size

23KB
MD5

5d68464e9b061d82c683b0494ee903b8
SHA1

649d239cab832f71e99968c073e4c1f498aa2f5c
SHA256

c03483e1f4645a6b01db2e96b0aa11f8fa00592481cdb2a10f3c423cdb47f8c3
SHA512

814b8ae329db54a207d3e752fb1a8e9d821118b723c2bff8c77d81003cecf965c19ac13d6d276fc5d8e5c991307c7d72f8468bfb21af2aba9be55a943c5979e8
SSDEEP

384:XC9uAqY6/KHLJxfQN3GHfG97Zf2662tt1V/0eK+xu6tng5lf6pUS7Ow:XC9uAqY6/KmiW7Zf2662P1V/RxHFul5K

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5d68464e9b061d82c683b0494ee903b8_JaffaCakes118

Files

5d68464e9b061d82c683b0494ee903b8_JaffaCakes118
.dll windows:4 windows x86 arch:x86

ac9dd75b8550cdc38afde21a8906add0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

RtlImageNtHeader
strchr
_stricmp
ZwOpenEvent
atoi
_snprintf
strstr
strncmp
sprintf
_chkstk
memcpy

msvcrt

realloc
strtok
malloc
free

kernel32

GetLastError
LocalAlloc
LoadLibraryA
GetProcAddress
InterlockedExchange
GetTempFileNameA
CreateFileA
GetFileSize
Sleep
ReadFile
CloseHandle
DeleteFileA
HeapFree
GetProcessHeap
MoveFileExA
FreeLibrary
WaitForSingleObject
SetEvent
VirtualAlloc
GetSystemTimeAsFileTime
GetModuleFileNameA
GetModuleHandleA
LoadLibraryExA
VirtualProtect
GetTempPathA
CreateThread
GetVolumeInformationA
HeapAlloc
RaiseException

Sections

.text
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ