aaf77ec6c871cb771e94b8713a14b9f1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

aaf77ec6c871cb771e94b8713a14b9f1_JaffaCakes118
Size

308KB
MD5

aaf77ec6c871cb771e94b8713a14b9f1
SHA1

21b3ec60fe5a0f9c334cca79f8bad0d31dbce943
SHA256

31cc29dd14882f8ede8c735475fc54668f8c8d47c1dd7a1a403899635959ccd2
SHA512

30c8fa49c68b73c4fb9248adf13ad5c697bf8faa6917d78b0d7ede97a2b0ff47d2450cd37cd6e16f6880388fec4ccc0e851efb15608f0c7987b59e4a9f7cd16a
SSDEEP

6144:JeLq+ikmYEFfqmhAnIK1h+YSBuDpI+7PsJPJ6ZddlJ653Gyut1oua:6ZiN1FZkdlVDPQQbnJ653Gyxua

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aaf77ec6c871cb771e94b8713a14b9f1_JaffaCakes118

Files

aaf77ec6c871cb771e94b8713a14b9f1_JaffaCakes118
.dll windows:4 windows x86 arch:x86

b476be43c29e49ae9f46c9fdf1288c5c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualProtect
VirtualAlloc
ExitProcess
VirtualFree
LoadLibraryA
GetProcAddress

user32

GetCursorPos

gdi32

LineTo

Sections

.text
Size: 231KB - Virtual size: 420KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.aspack
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ