61410f495ead5c4a58bec825039fdb84_JaffaCakes118 | Triage

Sharing

General

Target

61410f495ead5c4a58bec825039fdb84_JaffaCakes118
Size

122KB
MD5

61410f495ead5c4a58bec825039fdb84
SHA1

db654bc9a25f9a697d824f19f2792b790dc8b38d
SHA256

26c327aa94952bcb1153c4ceb33e6dfc0b5e9f20c858549251317fa7e9aaa129
SHA512

a520d4b7e3469587886a6d2591fc1e13db9bef565e9c336ace6b8596ef50587e5ee2a843e4bae8b90be8a476fa41c9157f8ae28ed8d8ced0ab30c2ab1275a739
SSDEEP

1536:AZwFVIqtQbFWSjOgz0Je+Y3biV2GMpT0elwjGfgoy:ONqtQbbRzWkiVts0eAGLy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
61410f495ead5c4a58bec825039fdb84_JaffaCakes118

Files

61410f495ead5c4a58bec825039fdb84_JaffaCakes118
.dll windows:9 windows x86 arch:x86

b90cae5398e45769a8b6a88b14be0e17

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

ShowWindow

kernel32

VirtualAlloc
RtlMoveMemory
MultiByteToWideChar
lstrlenA
lstrcmpiA
lstrcmpA
GetModuleHandleA
GetModuleFileNameA
GetCommandLineW
GetCommandLineA
GetACP
ExitProcess

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 415B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 221KB - Virtual size: 337KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 517B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ