8e6d3f69c910b1a4fc4c5c843ce1c8b3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8e6d3f69c910b1a4fc4c5c843ce1c8b3_JaffaCakes118
Size

5KB
MD5

8e6d3f69c910b1a4fc4c5c843ce1c8b3
SHA1

e078000f6a7c6b11bc6409e4b013778a82339fa3
SHA256

4f4211e3802d7cc51bc45ed311e9487f503fd1f7f0f3d9bea45585c3f5cf05e4
SHA512

499bc8659b809725cc0e875fa3e3d7f5baebf50f0efa401f77f7cfc4cd484db935368e0362ed1614b4bc2f97373b0aea3be195ab5133f3d2cd18f2e66f688643
SSDEEP

96:B13F5GOv83Tc765Cc0bXlDcR57eO1YjYnnnnnnv:z3FgcbV7Ynnv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e6d3f69c910b1a4fc4c5c843ce1c8b3_JaffaCakes118

Files

8e6d3f69c910b1a4fc4c5c843ce1c8b3_JaffaCakes118
.dll windows:4 windows x86 arch:x86

5bf2dfe00cbc258935a62c1f9a6d1a44

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TerminateProcess
GetCurrentProcess
DeleteFileA
FreeLibraryAndExitThread
MoveFileA
CopyFileA
GetTickCount
GetSystemDirectoryA
CloseHandle
CreateThread
lstrcmpiA
GetModuleFileNameA
GetModuleHandleA

user32

wsprintfA

shlwapi

PathFindFileNameA

msvcrt

fputc
fopen
fseek
fread
strcpy
fwrite
memset
fclose

Exports

Exports

foobar

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 767B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 190B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ