b589212981959c0550194d80a8a1b656_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b589212981959c0550194d80a8a1b656_JaffaCakes118
Size

18KB
MD5

b589212981959c0550194d80a8a1b656
SHA1

a1f806cd9e8dcee2833eea389059f2d5f99fe700
SHA256

cd478ca1b773e6e2805cdaac66e3437e240fe061cc462c386ff40800b551cd8a
SHA512

9d36b3cafea61d1a0ad5b55782a7df9ea79ffe2d18d42013a75199af163a09abb19ef353ba3a6385b1b49954548ecb6787c4fabdcfa3d1440d0ba8f3b21fd049
SSDEEP

192:RxFQ3WogEN125LxRLRyVUjmN6s+QPzDXxet0xJgK3G1A8CUEE7:R0i5LHNyCKN6sFP/Xxe+xJgK3m8UEE7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b589212981959c0550194d80a8a1b656_JaffaCakes118

Files

b589212981959c0550194d80a8a1b656_JaffaCakes118
.dll windows:4 windows x86 arch:x86

6292283d7b6bf175f9572788de1de92d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

AddAtomA
Beep
CreateThread
DisableThreadLibraryCalls
ExitProcess
FindAtomA
GetAtomNameA
GetModuleFileNameA
GetModuleHandleA
Sleep
VirtualProtect

msvcrt

__dllonexit
_errno
_iob
abort
fflush
fprintf
free
malloc
memcpy
strstr

user32

GetAsyncKeyState
MessageBeep
MessageBoxA

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 928B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ