b36f936489e85c3502e01b15e1e36b63_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b36f936489e85c3502e01b15e1e36b63_JaffaCakes118
Size

16KB
MD5

b36f936489e85c3502e01b15e1e36b63
SHA1

2c17630f044c4e18c43d5a255e721ef3d8cedc7d
SHA256

41dd23fa0c3dd8fb8d9df593cddef88b6ed9842fd0c2d8108bdaed7a6615b967
SHA512

95f672f0a32d0b2ccc9a97c0184b3aeebacce3c1d8fd73f4078eaf97fa8c2760f0bf5b9a0b6e10e8b8246837473ecf906ad9e94fe577478a1668551592643866
SSDEEP

192:kaVeiDFtnKOzDaKpGqUBlLZaVeiDFtnKOzDaKpGqUBlL:/xDzDaKpJUBZ8xDzDaKpJUBZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b36f936489e85c3502e01b15e1e36b63_JaffaCakes118

Files

b36f936489e85c3502e01b15e1e36b63_JaffaCakes118
.dll windows:4 windows x86 arch:x86

95ab8a47e1090389183ed659a1b1ae5b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
lstrcpyA
lstrlenA
Sleep
FindNextFileA
DeleteFileA
FindFirstFileA
VirtualFree
VirtualAlloc
lstrcatA
GetModuleHandleA
CreateProcessA
ReadFile
GetFileSize
OpenFile
OutputDebugStringA
LoadLibraryA
CreateThread
DisableThreadLibraryCalls
GetModuleFileNameA
GetTempPathA
CloseHandle
GetEnvironmentVariableA

Exports

Exports

LpkDllInitialize
LpkDrawTextEx
LpkEditControl
LpkExtTextOut
LpkGetCharacterPlacement
LpkGetTextExtentExPoint
LpkInitialize
LpkPSMTextOut
LpkTabbedTextOut
LpkUseGDIWidthCache
ftsWordBreak

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 966B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ