951be963fa1f330c885d2032b64acc9e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

951be963fa1f330c885d2032b64acc9e_JaffaCakes118
Size

14KB
MD5

951be963fa1f330c885d2032b64acc9e
SHA1

fd3af0b588ef1a6c7166b74a19d613dee55abb40
SHA256

26af87c4baa471694099ba68311ca230b3ae13f33f8c75e62fbe2cffb549cc9b
SHA512

92f7e37af1134e06de5bae42a1dff6feb245fd73b2eb9192e8b2903950f21035202e884fe3e50e82ce7644bf8d143034d93e3e9e6fcec8418ecc2ae9fd14bd9a
SSDEEP

192:USwnKrMttcMly9Eogw0jwnnF59zHJ4ESFOGZfVUH9CzT99N:bQBESG0knnF5klHUdCd3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
951be963fa1f330c885d2032b64acc9e_JaffaCakes118

Files

951be963fa1f330c885d2032b64acc9e_JaffaCakes118
.dll windows:4 windows x86 arch:x86

76f306cedf8a1dd05e83e6794ab8d0a6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\source\cg\cgall\rubbish\spi\Release\spi.pdb

Imports

kernel32

OutputDebugStringA
GlobalAlloc
GlobalFree
GetProcAddress
LoadLibraryW
ExpandEnvironmentStringsW
WideCharToMultiByte
lstrcmpA
GetCurrentProcessId
lstrlenA
LoadLibraryA
WriteFile
CloseHandle
CreateFileA
lstrcpyA
lstrcatA
GetSystemDirectoryA
FreeLibrary
GetModuleFileNameA
HeapAlloc
GetProcessHeap

ws2_32

WSCEnumProtocols
WSCGetProviderPath

user32

wvsprintfA
GetClassNameA
GetWindowThreadProcessId
EnumWindows
CharLowerBuffA

Exports

Exports

WSPStartup

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 658B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ