628e61477c1d785d91cee044a81e32a0_JaffaCakes118 | Triage

Sharing

General

Target

628e61477c1d785d91cee044a81e32a0_JaffaCakes118
Size

7KB
MD5

628e61477c1d785d91cee044a81e32a0
SHA1

20ee2e15cbcd16a1f21dc5b0adc7f99a16505ca2
SHA256

5c1b068ed054fe665d36a9d0ee6cc4ab8b6e5e8983d7c2a706426753ff2fbd72
SHA512

18503f7978d8632e02560c6250a7fd3553dbcfac00f4d2b5ee2d55b9fed1e72fc48a90e1fa4094ed04216b7c7fd0d5fdffbc89ec6658c87df3c47fa092b8cfd3
SSDEEP

96:HmqT1Ue9tHz5TSZPmAEdjY7ZosmOLEafhEctHSN:GqT1Ue1TSZP2duoWLL+TN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
628e61477c1d785d91cee044a81e32a0_JaffaCakes118

Files

628e61477c1d785d91cee044a81e32a0_JaffaCakes118
.dll windows:4 windows x86 arch:x86

af1186ead1cc5a71f7bc4452086ae8f2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
VirtualProtectEx
GlobalFree
IsBadReadPtr
GlobalLock
GlobalAlloc
GetCurrentProcess
CreateThread
GetModuleFileNameA
ReadProcessMemory

user32

EnumChildWindows
GetClassNameA
IsWindowVisible
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
SendMessageA
FindWindowA
FindWindowExA

wininet

InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetReadFile

msvcrt

strrchr
_adjust_fdiv
malloc
_initterm
free
memcpy
??3@YAXPAX@Z
strcmp
strlen
??2@YAPAXI@Z
sprintf
strcpy
_stricmp

Exports

Exports

fa
fc

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 508B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sdt
Size: 512B - Virtual size: 271B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ