788d4a53a6bc7e2c5a879c4495c41345_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

788d4a53a6bc7e2c5a879c4495c41345_JaffaCakes118
Size

8KB
MD5

788d4a53a6bc7e2c5a879c4495c41345
SHA1

8159e0cc8df4c1e366dd98f06f858b0927f18369
SHA256

53bec40f9b24cf8bc07c8b1424f26e909682c675410cf36d39764b009d43ee2c
SHA512

1415f77ad1eb76be91e90d43f516c82df09154fb513b994a35f8ecd76188c10705202daeba8a0f4fb7364ad6a1bbe233543921feaa9c79ed91f45d1450123bee
SSDEEP

192:DqXuKs5i0uzB5begFK1DbPnRVQSn6dO9:X7G15beuK1/JVQ46dO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
788d4a53a6bc7e2c5a879c4495c41345_JaffaCakes118

Files

788d4a53a6bc7e2c5a879c4495c41345_JaffaCakes118
.dll windows:4 windows x86 arch:x86

ff8615c15a477f4a8040d6ea6494c672

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiA
GetProcAddress
lstrlenA
GetFullPathNameA
lstrcpyA
CreateFileA
LoadLibraryExA
VirtualAlloc
FreeLibrary
Process32Next
Process32First
CreateToolhelp32Snapshot
SetThreadPriority
GetThreadPriority
GetModuleHandleA
VirtualFree
WriteFile
UnmapViewOfFile
MapViewOfFile
FlushViewOfFile
CloseHandle
LocalFree
GetVersionExA
Sleep
DisableThreadLibraryCalls

advapi32

RegOpenKeyA
RegCreateKeyA
RegSetValueExA
RegCloseKey
GetSecurityInfo
SetEntriesInAclA
SetSecurityInfo
RegDeleteKeyA

msvcr71

_initterm
malloc
_adjust_fdiv
__CppXcptFilter
_except_handler3
__dllonexit
_onexit
free

Exports

Exports

H2P

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ