a72d9949f9264c50956e12771d743849_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a72d9949f9264c50956e12771d743849_JaffaCakes118
Size

162KB
MD5

a72d9949f9264c50956e12771d743849
SHA1

6adf30790c8bc8546abcb0c69f96a14b1a56e71b
SHA256

1b363b4e4b703d4a9ddb42076899cd4f55a5e100f809e0f6d95197597776b160
SHA512

8229995d19d419133fd701792d30fd401fc57b41c57dc58b216fb31efcbdb71c2e2b6e0e3f31d763ee660e19e341a5003fe9d4f7ef85a7b4abdba9b5118207c1
SSDEEP

3072:CqBUeqxj5+L4jQt0lUgarbLEqV4xkX1VvGG/JSIjtnHlkMGSaXqzX7dSGIQFVta2:Cq9qx8Estcar86ESVflpyMaXqzX7dSEb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a72d9949f9264c50956e12771d743849_JaffaCakes118

Files

a72d9949f9264c50956e12771d743849_JaffaCakes118
.dll windows:4 windows x86 arch:x86

4501f0f4bcc646a898d54d563cbe3707

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCommandLineA
VirtualProtectEx
LoadLibraryA
ExitProcess
GetLastError
OpenThread
GetThreadContext

user32

PostMessageA
IsChild

Exports

Exports

Qsijetbeex
BeginIexeaynsjd

Sections

.text
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.DATA2
Size: 3KB - Virtual size: 304KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 150KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.enill
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ