71f1752c7006484a13a3f78173cdb643_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

71f1752c7006484a13a3f78173cdb643_JaffaCakes118
Size

99KB
MD5

71f1752c7006484a13a3f78173cdb643
SHA1

6c4d1cd02c506855f143fb9b9f8191a3f0532a08
SHA256

355c8140406e14825dd7d9441f6a8047519d5d0401373d67ff5c45f6d62e4339
SHA512

f6e0b8fb658fdd4f955ae0885297f390ecbe12e483a0f11e000da46415fed520aaf838bdce2032571ae38772c50af2440194727c87fe45b03412217ad160a788
SSDEEP

3072:IAhunkCEPdfHWz2kCCKld6vDPleOUgG9jl:IAckzlP/Vj76vDnA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
71f1752c7006484a13a3f78173cdb643_JaffaCakes118

Files

71f1752c7006484a13a3f78173cdb643_JaffaCakes118
.dll windows:4 windows x86 arch:x86

f1dc948a256cf1da9cdb42389386d691

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

ToAscii
RegisterClassW
OffsetRect
MessageBoxIndirectW
MessageBeep
GetMessageW
FillRect
EmptyClipboard
DispatchMessageW

kernel32

GetOEMCP
InterlockedIncrement
GetUserDefaultLCID
GetConsoleCP
FatalAppExitW
ExitProcess
lstrcatW
SetEnvironmentVariableW
IsDebuggerPresent
DebugBreak
IsBadReadPtr

advapi32

RegOpenKeyExW
RegCloseKey

comdlg32

GetOpenFileNameW
GetFileTitleW

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dataa
Size: 13KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ