642f26d5dd9c2a565a061f717fe99c02_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

642f26d5dd9c2a565a061f717fe99c02_JaffaCakes118
Size

160KB
MD5

642f26d5dd9c2a565a061f717fe99c02
SHA1

6b282275ffbca09b449a8caad2369d75d2044a74
SHA256

d9df7ab03c0c33b372788c033bbbc6582a7065d96a31ca6248c9336001e99cf1
SHA512

48cc78bbf5ab591ecd2b7652a3dab71b637b714535083f0e2c022bb3200e6e4e4c61012c6d323b29b49417fa7b6ccc5da7b885c54f03f5c35229ad5c48a1a06a
SSDEEP

3072:pvlODH9Z88hBzSBM0HJb9Zc53xeRDXUSQ5N0QoDo0zZ0LRkTs1:1lODH9Z8EoBhlc5IzzQgQyVORkg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
642f26d5dd9c2a565a061f717fe99c02_JaffaCakes118

Files

642f26d5dd9c2a565a061f717fe99c02_JaffaCakes118
.dll windows:4 windows x86 arch:x86

baaefdf31431fe69def30fc0d5e9feea

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CreateEventA
CreateProcessA
ExitProcess
FindResourceA
FlushFileBuffers
GetACP
GetCommandLineA
GetConsoleMode
GetFileType
GetModuleHandleA
GetOEMCP
GetPriorityClass
GetProcessAffinityMask
GetStartupInfoA
GlobalAlloc
HeapAlloc
HeapCreate
HeapReAlloc
InterlockedExchange
IsDebuggerPresent
MulDiv
MultiByteToWideChar
ResetEvent
RtlUnwind
SetLastError
SetUnhandledExceptionFilter
TlsSetValue
VirtualFree
lstrcatA
lstrlenW

user32

GetWindow
IntersectRect
LoadImageA
GetUpdateRgn
UpdateWindow
WindowFromPoint
GetMenuCheckMarkDimensions
RegisterWindowMessageA
CheckRadioButton

comdlg32

GetOpenFileNameA
PrintDlgExA

Exports

Exports

D3DBreakVBLock

Sections

.text
Size: 99KB - Virtual size: 212KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 58KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ