a49b900d66d64c3810f2ab9305682131_JaffaCakes118 | Triage

Sharing

General

Target

a49b900d66d64c3810f2ab9305682131_JaffaCakes118
Size

96KB
MD5

a49b900d66d64c3810f2ab9305682131
SHA1

da4c7da33dac20e9c25b836a9be47b5722277ca4
SHA256

0599f786af63a2684ccc39459ce716b9fae90b086e1dd1970037d0925c50fcb3
SHA512

2c615984e9fa8174d29529eda02a1c1a774f8d1ba9d74d285b0ef82a666b8069315343ee78ee64c96869ed8b6a2aeae9c3c631c7764737448e5906e945fba847
SSDEEP

1536:yoo9VABcuOVhVZHdzG7PUSkTmRQU9dEUx1YH5jx0WG5zL2nxNg4p9AzgUal:yLABpOlZH9wPfkqRQ2dYjnm/ohWgUal

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a49b900d66d64c3810f2ab9305682131_JaffaCakes118

Files

a49b900d66d64c3810f2ab9305682131_JaffaCakes118
.dll windows:4 windows x86 arch:x86

e1efd8a1a2b4c10e3625055049ba9939

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

InternetReadFile

msvcrt

fread

kernel32

ResumeThread
LoadLibraryA
VirtualProtect
GetModuleFileNameA

user32

CharUpperA
MessageBoxA

advapi32

QueryServiceConfigA

shell32

SHGetSpecialFolderPathA

ole32

CoCreateGuid

Exports

Exports

_DllMain@12

Sections

.text
Size: - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bad0
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bad1
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.bad2
Size: 64KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ