9583a2778b78c5aea37feb8d05cadb48_JaffaCakes118

General

Target

9583a2778b78c5aea37feb8d05cadb48_JaffaCakes118
Size

9KB
MD5

9583a2778b78c5aea37feb8d05cadb48
SHA1

db720fee26962824028333b1e47c35437064c9dd
SHA256

4183c7217ef814bdb85ebbcf85632963def5348627dedb2f2d5b4bf31ce96ee6
SHA512

edd3cfbbc909693c554ee6962f9fdb3b1ad92719b8c4ba10a9ff100b0ea10a7ddd9baa1bf9760cc0bab101a9692772c434b88abf1604cca0de89ddde23b4b1cf
SSDEEP

96:mU0kqeB7PNsZKPCi8a8YYZ7FDGfTcTaNjjQXN/inYXsxVTWzi/zi:uk9BPCicYYZ7FD4HK1inYfzi/z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9583a2778b78c5aea37feb8d05cadb48_JaffaCakes118

Files

9583a2778b78c5aea37feb8d05cadb48_JaffaCakes118
.dll windows:4 windows x86 arch:x86

c91d3c8673d041118017fa1f853ace09

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

msvcrt-ruby191

onigenc_ascii_apply_all_case_fold
onigenc_ascii_get_case_fold_codes_by_str
onigenc_is_mbc_newline_0x0a
onigenc_mb2_code_to_mbc
onigenc_mb2_code_to_mbclen
onigenc_mb2_is_code_ctype
onigenc_mbclen_approximate
onigenc_mbn_mbc_case_fold
onigenc_mbn_mbc_to_code
onigenc_minimum_property_name_to_ctype
onigenc_not_support_get_ctype_code_range
rb_enc_register

kernel32

AddAtomA
FindAtomA
GetAtomNameA
VirtualProtect
VirtualQuery

msvcrt

__dllonexit
_assert
_errno
_iob
abort
fflush
free
fwrite
malloc
memcpy
memset
vfprintf

Exports

Exports

Init_gbk

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 212B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 66B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c91d3c8673d041118017fa1f853ace09

Headers

File Characteristics

Imports

msvcrt-ruby191

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 3KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 2KB

.bss Size: - Virtual size: 212B

.edata Size: 512B - Virtual size: 66B

.idata Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 288B

.text
Size: 3KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 2KB

.bss
Size: - Virtual size: 212B

.edata
Size: 512B - Virtual size: 66B

.idata
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 288B