645ec786528af65dd6f10a4ee6b0230f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

645ec786528af65dd6f10a4ee6b0230f_JaffaCakes118
Size

13KB
MD5

645ec786528af65dd6f10a4ee6b0230f
SHA1

58b2a6a9d9bd8e1a815ad76c792b89360c9b9168
SHA256

70305e142c12c8bc3eb54da49aa4ab672deb9a7b3bccfae6aa8c77ee69bc8fb0
SHA512

a892af7c03b79f735d82073d79389d4f37ef1f819839bf6d3a37b3ca88b6f7069b79bcd9d4461c1c8e76fad79c3f4b18e1c8160aeb2df56493e159f03f00069e
SSDEEP

192:SxiGWoaoj9fW3HpYrQXDCdRB4lOVpLSxVUhyJhXfHhXw6/FefXtNYJ1G:S0GWoaojpW3sWCXBIqVyPBASFefGG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
645ec786528af65dd6f10a4ee6b0230f_JaffaCakes118

Files

645ec786528af65dd6f10a4ee6b0230f_JaffaCakes118
.dll windows:4 windows x86 arch:x86

78c63ee6f2b75916420b00ed88456f09

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

FindWindowA
GetWindowThreadProcessId
wsprintfA

kernel32

IsBadReadPtr
GetStringTypeA
RtlUnwind
LCMapStringW
CloseHandle
CreateRemoteThread
CreateThread
ExitProcess
GetCurrentProcess
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetTickCount
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
GlobalLock
GetStringTypeW
OpenProcess
ReadProcessMemory
RtlZeroMemory
Sleep
VirtualAllocEx
WriteProcessMemory
LCMapStringA
MultiByteToWideChar
WideCharToMultiByte

wininet

InternetOpenA
InternetOpenUrlA

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 1002B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 526B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ