648da94c78efd48d9eeb97294b97da35_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

648da94c78efd48d9eeb97294b97da35_JaffaCakes118
Size

1.8MB
MD5

648da94c78efd48d9eeb97294b97da35
SHA1

b8618add021b996a5a4918456b23d345aad8c6bc
SHA256

d041643e3a43a89256b1a51330107628deec8802acd1f3480e7134bca83c0e37
SHA512

04d8e2cf430f39d9ab100f2112d1a706def1d00f8eac171b2fb9b44e8901741f9e29b40d96be111fd8142ec8b52ddcbd96fc59a5f00eea10318e301f6489876a
SSDEEP

24576:6eAfYe9ynA32vNLtRjol/mAfxhnN54u6poD2EgEOCaq7E/s7hH9P+pWPFOGXYBtU:oYCn8tR/gvPMAOC37Csp9P+APFO+YBy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
648da94c78efd48d9eeb97294b97da35_JaffaCakes118

Files

648da94c78efd48d9eeb97294b97da35_JaffaCakes118
.dll windows:4 windows x86 arch:x86

d55f69317625ec63103d1b4419700f79

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

MessageBoxA
GetKeyboardType

kernel32

GetVersionExA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameA
GetModuleFileNameW
VirtualFree
VirtualAlloc
ReadProcessMemory
GetCurrentProcess
VirtualQuery
GetCurrentProcessId
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
LoadLibraryA

oleaut32

SysFreeString

advapi32

RegQueryValueExA

gdi32

UnrealizeObject

version

VerQueryValueA

ole32

CoTaskMemFree

comctl32

_TrackMouseEvent

winmm

timeGetTime

Sections

.rdata
Size: - Virtual size: 10.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 25KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE