7711db13111f3f905bc22ca79afe137d_JaffaCakes118 | Triage

Sharing

General

Target

7711db13111f3f905bc22ca79afe137d_JaffaCakes118
Size

15KB
MD5

7711db13111f3f905bc22ca79afe137d
SHA1

e446960a844b212c99dfa2f4e1f3698add51491c
SHA256

b9392955952c3580e2c093204b3a389a568ad426a7e4fe5fba23a1723325ed0d
SHA512

29fd699f5bac5b3c0192d3fa6e053d5ec472c98aab275fa15196dc6d8b0edf83f11a82932997ceae03c8090961faec3276b01d06419e9ae020c835243a82f753
SSDEEP

192:yIpJ4hT9Ie5mKveZzwXbChDnZmRICobUFYpyh+0r+TWUUfzr:Fp+d9x57euX2hrZdRbdTTTWrzr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7711db13111f3f905bc22ca79afe137d_JaffaCakes118

Files

7711db13111f3f905bc22ca79afe137d_JaffaCakes118
.dll windows:4 windows x86 arch:x86

0b851b78250014e6e83ab234310bd972

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OpenProcess
GetCurrentProcessId
LeaveCriticalSection
EnterCriticalSection
lstrcpynA
GetFileSize
CloseHandle
ReadFile
SetFilePointer
CreateFileA
VirtualProtect
TerminateProcess
GetProcessHeap
HeapAlloc
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetCurrentProcess
InitializeCriticalSection
Sleep
GetPrivateProfileStringA
GetModuleFileNameA
CreateThread

msvcrt

strlen
_stricmp
strcmp
strncpy
malloc
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
memcpy
_itoa
strrchr
__dllonexit
_onexit
_initterm
_adjust_fdiv
_strcmpi
_except_handler3
sprintf
strstr
memset
strcpy
free
strcat

user32

wvsprintfA

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ