ac352df8b34f64f4354a9c4d5aec14e3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ac352df8b34f64f4354a9c4d5aec14e3_JaffaCakes118
Size

6KB
MD5

ac352df8b34f64f4354a9c4d5aec14e3
SHA1

4b0b4286235306d87d9376efde895d74c92b4c19
SHA256

f2e9da54598bcc9fb629793e79536f7db87fbcee897cfe8828e197fa56d9a073
SHA512

b831b5e06758682621a147d88149a4ccb69d5b87e6ccef3dd66294eaee03c9629f4a5f17f3d93124f79b14c73caafa3c968ae1f9feb6003f4027796f343c8b2f
SSDEEP

96:nd/xIrgxB4ck+uXoqpxsxT1GLGhGQnwi7VjK19xnCg8gLuHrV90kkTEIeN:nd/ek8ck7XHpxsxT0eVm19xCKKp9VxN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ac352df8b34f64f4354a9c4d5aec14e3_JaffaCakes118

Files

ac352df8b34f64f4354a9c4d5aec14e3_JaffaCakes118
.dll windows:4 windows x86 arch:x86

8f2160992ca5322c5920bf6cb6b0a025

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetSystemDirectoryA
VirtualProtect
GetProcAddress
GetLastError
GetModuleFileNameA
FindNextFileW
CreateThread
Sleep
LoadLibraryA

user32

CallNextHookEx
SetWindowsHookExA

advapi32

RegOpenKeyA
RegSetValueExA

msvcrt

free
_strcmpi
_stricmp
strrchr
mbstowcs
wcsncpy
wcslen
_wcsicmp
_initterm
malloc
_adjust_fdiv

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 788B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 450B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ