ab92cf35704c29773465a6568f8d7afc_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ab92cf35704c29773465a6568f8d7afc_JaffaCakes118
Size

52KB
MD5

ab92cf35704c29773465a6568f8d7afc
SHA1

1ed4a28dfc5eb0e68e0557a63a5897312a570563
SHA256

128c5a814adfb211a74a7c266c1ca19e7767821301e3c38417474f7927d2f7e8
SHA512

5ca069c1206215c641853d61c9c5dc8cb97ccba686f13141918e0ca0ca128e7c90211a916370562df005f2c284108f8b336526206436042a6843d6c9d16e994a
SSDEEP

1536:a3idBevKuP4LCb/YiLZY9My7ye6Us9F9EH:aydBeCubb/YiWZ7yeTs7+H

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ab92cf35704c29773465a6568f8d7afc_JaffaCakes118

Files

ab92cf35704c29773465a6568f8d7afc_JaffaCakes118
.dll windows:4 windows x86 arch:x86

471c72f112e180f798a6fe17ec9ef21f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

BlockInput

gdi32

GetDIBits

advapi32

LsaFreeMemory

shell32

SHGetSpecialFolderPathA

msvcrt

_strnicmp

winmm

waveOutUnprepareHeader

ws2_32

WSAStartup

msvcp60

?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ

imm32

ImmReleaseContext

wininet

InternetReadFile

msvfw32

ICSeqCompressFrame

wtsapi32

WTSFreeMemory

userenv

CreateEnvironmentBlock

psapi

EnumProcessModules

Exports

Exports

Install
MyNewFun
wintest

Sections

.text
Size: 45KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE