b173e62f2e3d15d7932c0a29df6c90b6_JaffaCakes118 | Triage

Sharing

General

Target

b173e62f2e3d15d7932c0a29df6c90b6_JaffaCakes118
Size

11KB
MD5

b173e62f2e3d15d7932c0a29df6c90b6
SHA1

da5c8f7b8e5a990d9dc5c170baddfdf230c2e6be
SHA256

b340a975d3cc2125e7c62f01a1a4da6ae30477fb02174e6cfc81de3f52524cda
SHA512

222044f1cd3838960840d1ac11006352c01541cd0d63dda59f39b3a5afaa97fa14f9698e4c1b4ae9d0a2b688cadbe620b7def0eb0bb3198ac15dc08f8c982462
SSDEEP

192:ecknDVo57EN4k0CiVvOaq13COCWF1zvFuh33t/nlC5QwQ4Js2dHal:ecknDg7ENUfvlKCOtzvoVRs5HJdHy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b173e62f2e3d15d7932c0a29df6c90b6_JaffaCakes118

Files

b173e62f2e3d15d7932c0a29df6c90b6_JaffaCakes118
.dll windows:5 windows x86 arch:x86

bd565320e338b89ca9a2b3e0f9d7350d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ExitProcess
CreateFileA
GetFileSize
SetFilePointer
HeapAlloc
HeapFree
WaitForSingleObject
GetTickCount
GetProcessHeap
GetSystemTimeAsFileTime
WriteFile
Sleep
CreateProcessA
ReadFile
FindFirstFileA
FindClose
MoveFileA
GetModuleFileNameA
GetModuleHandleA
VirtualProtect
CloseHandle
GetVersion
DeleteFileA
CreateThread

user32

GetWindowThreadProcessId
OemKeyScan
EnumChildWindows
GetDlgItem
GetWindowLongA
EnumWindows
CloseDesktop
GetClientRect
FindWindowExA
CreateDesktopA
GetClassNameA

Exports

Exports

_Main@0

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 910B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ