a4d4eb87063689935e1ac8f9487a2f8f_JaffaCakes118 | Triage

Sharing

General

Target

a4d4eb87063689935e1ac8f9487a2f8f_JaffaCakes118
Size

20KB
MD5

a4d4eb87063689935e1ac8f9487a2f8f
SHA1

0088503c941d6050e6e30ffcbe3c02975440d938
SHA256

effc03485c4f2bffe9f74c7e5e99989d33f86dabf89fe3ef3af163f1c6cb209a
SHA512

6fa215a9e6658fd1706482903f62ffd5367d6c73675d5ec8b02e1282d79de87b55dce016a87430985a635f130e6f2ae5eda687933a208e069d30479326f4f133
SSDEEP

192:QbMQ+qYsVLJtwSZCWwOGNfMG9PrNtpT/Jvm4:bcBJuWwOGn95rl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a4d4eb87063689935e1ac8f9487a2f8f_JaffaCakes118

Files

a4d4eb87063689935e1ac8f9487a2f8f_JaffaCakes118
.dll windows:4 windows x86 arch:x86

050ca18655e35d25b6b8020eae973aa3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcessId
GetWindowsDirectoryA
GetProcAddress
LoadLibraryA
CreateFileA
ReadFile
Module32First
GetModuleHandleA
GetModuleFileNameA
CreateThread
GetPrivateProfileStringA
Sleep
Module32Next
lstrlenA
ReadProcessMemory
OpenProcess
VirtualProtectEx
WriteProcessMemory
CreateToolhelp32Snapshot
CloseHandle

user32

wsprintfA
GetWindowThreadProcessId
EnumWindows

shlwapi

StrStrIA

msvcrt

strchr
strcmp
atoi
strcpy
??2@YAPAXI@Z
memcpy
_purecall
isprint
memset
??3@YAXPAX@Z

Sections

.bss
Size: - Virtual size: 11KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

shard
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ