a4d060ce468c558302b66d56a1cc6401_JaffaCakes118 | Triage

Sharing

General

Target

a4d060ce468c558302b66d56a1cc6401_JaffaCakes118
Size

65KB
MD5

a4d060ce468c558302b66d56a1cc6401
SHA1

a2dc5c4bab72a2b2c54a4e340436a6aa8fe36b7f
SHA256

f68784b0f42b4c0b9a5d2e054d92843374f39c59ef4e9f802f8414907da979ed
SHA512

174430c9a16da82ae137538586fd68737066dd96a62c7887a76dba6aecfd2077c898b21fa883a8982839e5e9361ee7e9fd1dd0f595c83803c59767ea2cdedfee
SSDEEP

1536:vSwlKC19SnIhSmpiu2Q0kUewqfWg3rr7ctQky9LGMp4Gu9:nAMpBIkUewtO7ctQkqLGP9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a4d060ce468c558302b66d56a1cc6401_JaffaCakes118

Files

a4d060ce468c558302b66d56a1cc6401_JaffaCakes118
.dll windows:4 windows x86 arch:x86

946a5c3d9d1f8e65a51d73020a599993

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

msvcrt

_vsnprintf

wsock32

connect

gdi32

DeleteObject

user32

UnhookWindowsHookEx

Exports

Exports

CancelDll
LoadDll

Sections

.text
Size: 16KB - Virtual size: 6.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE