642afd064c96e620b70c79f97dd5d70d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

642afd064c96e620b70c79f97dd5d70d_JaffaCakes118
Size

85KB
MD5

642afd064c96e620b70c79f97dd5d70d
SHA1

a8fb82442c7416c6b90e163b711110f7c3d0f3bd
SHA256

9182504926ad44601827f913af9c961b1fdc8dab4a857a585127770bcc485273
SHA512

f217fd223d66c80c0c4f255777d5c744aa27818803c6fbe87e15b897435f8c9d9bb9647f2bf017a5474c84cf3138fa2ab6af34aa69813c3126f854c39425e275
SSDEEP

1536:8aZj8W/y0Omc/JY94NBA3y99eI9hgxYB4fo4T4iqXMLSSMUD1v6tAr8/gyANyFYU:8ap8b9yqm3y9QI9qdfo4T4iqmSSHcAI1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
642afd064c96e620b70c79f97dd5d70d_JaffaCakes118

Files

642afd064c96e620b70c79f97dd5d70d_JaffaCakes118
.dll windows:4 windows x86 arch:x86

f579537dc49ac210a45476585b50c0a9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualAlloc
GetProcAddress
LoadLibraryA
GetModuleHandleA
VirtualProtect
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
GetLastError
CreateMutexA
SetLastError
GetModuleFileNameA

msvcrt

sprintf
memcpy

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 490B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE