75fae204f8d263ed23ef7f7032022ed0_JaffaCakes118

General

Target

75fae204f8d263ed23ef7f7032022ed0_JaffaCakes118
Size

9KB
MD5

75fae204f8d263ed23ef7f7032022ed0
SHA1

423e60cde6b0edbe195fe154d65b9e757b193af2
SHA256

5c0602c4f696e4c8e8ba5ed391a99b71353c598ece7354d9ba4375797928abf7
SHA512

ed45451d7540421962ca05169243cff292cd469181249cd1a95803f944d90f4b67212100f3eca774bbd94a4942261441f554d59ac0fb237d95fb5802b2503334
SSDEEP

96:gdJ8qemKjIx1C+KW4WNGOS4kmXntiAnuzKxVTWzi/zi:085uCpW4WNGwntiAnohzi/z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
75fae204f8d263ed23ef7f7032022ed0_JaffaCakes118

Files

75fae204f8d263ed23ef7f7032022ed0_JaffaCakes118
.dll windows:4 windows x86 arch:x86

c91d3c8673d041118017fa1f853ace09

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

msvcrt-ruby191

onigenc_ascii_apply_all_case_fold
onigenc_ascii_get_case_fold_codes_by_str
onigenc_is_mbc_newline_0x0a
onigenc_mb2_code_to_mbc
onigenc_mb2_code_to_mbclen
onigenc_mb2_is_code_ctype
onigenc_mbclen_approximate
onigenc_mbn_mbc_case_fold
onigenc_mbn_mbc_to_code
onigenc_minimum_property_name_to_ctype
onigenc_not_support_get_ctype_code_range
rb_enc_register

kernel32

AddAtomA
FindAtomA
GetAtomNameA
VirtualProtect
VirtualQuery

msvcrt

__dllonexit
_assert
_errno
_iob
abort
fflush
free
fwrite
malloc
memcpy
memset
vfprintf

Exports

Exports

Init_cp949

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 212B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 70B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c91d3c8673d041118017fa1f853ace09

Headers

File Characteristics

Imports

msvcrt-ruby191

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 3KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 2KB

.bss Size: - Virtual size: 212B

.edata Size: 512B - Virtual size: 70B

.idata Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 288B

.text
Size: 3KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 2KB

.bss
Size: - Virtual size: 212B

.edata
Size: 512B - Virtual size: 70B

.idata
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 288B