730aacbd78dca2f81774ac6081bf766b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

730aacbd78dca2f81774ac6081bf766b_JaffaCakes118
Size

10KB
MD5

730aacbd78dca2f81774ac6081bf766b
SHA1

c0c58fde7160fbc1de49ea81fd2428fd833fdda8
SHA256

6685e40d3510f18c8c83607a5408ca000907e6494654fe26d747d5ae45e83a59
SHA512

e46267a763ad092de1886ac6cc0c8653e627dece10f36c026124ef26b83a4e283f41e8c9f8da721a680afca3be867bb8fb6cc02a5508563c23270d035f389b35
SSDEEP

192:hy44PdoKah7qKcDQfdpQ5h+hHGBvKyDV0Lc+PrDVWKvFiY:wFuqK7bKvKKVIVWKvI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
730aacbd78dca2f81774ac6081bf766b_JaffaCakes118

Files

730aacbd78dca2f81774ac6081bf766b_JaffaCakes118
.dll windows:4 windows x86 arch:x86

73bfd70d3c8781f7dadcb02a2f6aa259

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CompareStringA
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetProcAddress
GetModuleHandleA
lstrlenA
CreateThread
GetModuleFileNameA
IsBadReadPtr
GetCurrentProcess
FreeLibrary
InterlockedExchange
RtlUnwind
VirtualProtect
GetProcessHeap
OpenProcess
HeapAlloc
VirtualQuery

user32

TranslateMessage
GetMessageA
KillTimer
SetTimer
FindWindowA
GetWindowThreadProcessId
DispatchMessageA
wsprintfA

advapi32

AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA

wininet

InternetOpenUrlA
InternetReadFile
InternetCloseHandle
InternetOpenA

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 646B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ