825c9b98dc5b02a900e859ba48e98dfb_JaffaCakes118 | Triage

Sharing

General

Target

825c9b98dc5b02a900e859ba48e98dfb_JaffaCakes118
Size

17KB
MD5

825c9b98dc5b02a900e859ba48e98dfb
SHA1

0b4a9fefa45ddf16631d00859e54f75a31cf2235
SHA256

f1b68826f8998cfb353ae3f45cafc1cdd06bec0cde8f3cca904e749fdb23480c
SHA512

5404a9c629658299a1366f329641d739c68eb210d145edc287ad9e191d239404e272409cccf64a23af5991e1436a251726d4ccae191383978c24348d2073e566
SSDEEP

192:9NthP4UJEmHd6qb7lHR33cHYQ+poPb33RkgjcVGE9h6VGhddFuQmFDsioFXsFitP:pN4nAZx33c4WPb3vUIGhddIQmhNOi0P

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
825c9b98dc5b02a900e859ba48e98dfb_JaffaCakes118

Files

825c9b98dc5b02a900e859ba48e98dfb_JaffaCakes118
.dll windows:4 windows x86 arch:x86

707eaf3c018c78475e6a64d80574894d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetSystemDirectoryA
GetCurrentProcessId
FreeLibrary
GetTempPathA
GetWindowsDirectoryA
CreateMutexA
lstrcatA
DisableThreadLibraryCalls
GetCurrentProcess
Sleep
LoadLibraryA
ExitProcess
CreateThread
GetProcAddress

user32

GetWindowTextA
PostMessageA
GetForegroundWindow
wsprintfA
keybd_event
FindWindowExA

advapi32

DeleteService
LookupPrivilegeValueA

msvcrt

fopen
printf
fscanf
fclose
??2@YAPAXI@Z

Exports

Exports

CompareLinkInfoReferents
CompareLinkInfoVolumes
CreateLinkInfo
CreateLinkInfoA
CreateLinkInfoW
DestroyLinkInfo
DisconnectLinkInfo
GetCanonicalPathInfo
GetCanonicalPathInfoA
GetCanonicalPathInfoW
GetLinkInfoData
IsValidLinkInfo
MSCON
ResolveLinkInfo
ResolveLinkInfoA
ResolveLinkInfoW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 798B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ