94f6bfac03b143575ef10b2a40bb8eab_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

94f6bfac03b143575ef10b2a40bb8eab_JaffaCakes118
Size

52KB
MD5

94f6bfac03b143575ef10b2a40bb8eab
SHA1

6f6bfdb688f7152b16dd4fdbfd4a32b2c16e521a
SHA256

00ddd50930c3192e71462f39e7727cde4c1dc7e4ebde773883bc97da5d3096fa
SHA512

7dee92a6893267da25f8b73bd128bb21c13c0b71664565aaca89bf211dcf7c5d4884bae20e87ec4a284ee5e7cdd78866a813457e56c0d94096487edba6aa6c5e
SSDEEP

1536:03igsUUqNzUVVMtR8fE0xwqJOArG35cci:0ygfUqLv88awkPG35Zi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
94f6bfac03b143575ef10b2a40bb8eab_JaffaCakes118

Files

94f6bfac03b143575ef10b2a40bb8eab_JaffaCakes118
.dll windows:4 windows x86 arch:x86

471c72f112e180f798a6fe17ec9ef21f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

BlockInput

gdi32

GetDIBits

advapi32

LsaFreeMemory

shell32

SHGetSpecialFolderPathA

msvcrt

_strnicmp

winmm

waveOutUnprepareHeader

ws2_32

WSAStartup

msvcp60

?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ

imm32

ImmReleaseContext

wininet

InternetReadFile

msvfw32

ICSeqCompressFrame

wtsapi32

WTSFreeMemory

userenv

CreateEnvironmentBlock

psapi

EnumProcessModules

Exports

Exports

Install
MyNewFun
wintest

Sections

.text
Size: 45KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE