971d79b805c84e5694e1b6fd02db7711_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

971d79b805c84e5694e1b6fd02db7711_JaffaCakes118
Size

68KB
MD5

971d79b805c84e5694e1b6fd02db7711
SHA1

26db54e857650f8d6dd8e7516dd6f7710c9a023e
SHA256

1af5cef1c8bcc64508f7cf9e5c58ac853d3894cdfc1725f764c9032a69cf97f5
SHA512

7272b8931dc4a5e0952de0ce611a268cba43ad70419b30fc223e27b19bf79ae79fba1adb754b8a0d1e8037fa5e2c7af44989572814ef97794bb9d56d7e16a935
SSDEEP

1536:eq4vR0WFckIKida2fl/wWbesHFfhZVPiFjkYNZ1:iWKl87RTLiFjkYNZ1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
971d79b805c84e5694e1b6fd02db7711_JaffaCakes118

Files

971d79b805c84e5694e1b6fd02db7711_JaffaCakes118
.dll windows:4 windows x86 arch:x86

70a0452ca6ff4be9ea53371fd46c80bc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
DeleteCriticalSection
InitializeCriticalSection
HeapDestroy
lstrlenA
MultiByteToWideChar
lstrcpynA
lstrcmpiA
GetVersion
GetCommandLineA
VirtualProtect
DisableThreadLibraryCalls

user32

CharNextA

advapi32

RegDeleteValueA
RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegCreateKeyExA

ole32

CoTaskMemFree

msvcrt

_initterm
rand
localtime
time
_except_handler3
_adjust_fdiv
free
malloc
_ftol

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ