5f4ef3e23ae324b12410238ddcaf8bdd_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5f4ef3e23ae324b12410238ddcaf8bdd_JaffaCakes118
Size

31KB
MD5

5f4ef3e23ae324b12410238ddcaf8bdd
SHA1

55cb53581a5e7eac87f59eabdcd645af86ba4914
SHA256

5a5824f913c9f8610085b4b09954f0b2505a426664ee645f8ed2fa18567740cf
SHA512

99e18611f959199b4c1bab5e0e6e46cdf7bda88a74cea8c1c7ad178ee206fa323ab403a9f5adc5ef3c69a55d01de4a111cf2e7b958cada3cb00a306edaa57803
SSDEEP

768:o8WWERA7j3D16iHMjWXlQlqOEUq1hva3:o8WxA7f+i43q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5f4ef3e23ae324b12410238ddcaf8bdd_JaffaCakes118

Files

5f4ef3e23ae324b12410238ddcaf8bdd_JaffaCakes118
.dll windows:4 windows x86 arch:x86

42e8f5af17946ef279444e9ec550e7da

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

SetWindowsHookExA
GetWindowThreadProcessId
GetAsyncKeyState
FindWindowA
CallNextHookEx
wsprintfA

kernel32

GetPrivateProfileIntA
lstrlenA
lstrcmpiA
VirtualProtect
Sleep
RtlMoveMemory
GetTimeFormatA
CreateThread
GetModuleFileNameA
GetPrivateProfileStringA

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 516B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ