b37c1423c3241e87ff0c1aa399de9bc6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b37c1423c3241e87ff0c1aa399de9bc6_JaffaCakes118
Size

8KB
MD5

b37c1423c3241e87ff0c1aa399de9bc6
SHA1

6f2bbf03fa1fbadb2f96c92c1ef84d63f8467906
SHA256

3130c4f8b159ced3f633af9b1ad53f1bbd5f76a1a268fee7de3b2f8a42eb74a4
SHA512

fdd5ef33efd51740b2ea9d2342f3e9d3e355cc858cd4246ee6547aee4516d0a3af745a57d5403a018b35d41e0fe6630e847e0cf3acb3b63b976e63e59f9fb9fb
SSDEEP

192:2sv3T3bVp3t5v/ATH1Doy0XfFUJ5TGpDx:NPjB1biVDfH5TGpV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b37c1423c3241e87ff0c1aa399de9bc6_JaffaCakes118

Files

b37c1423c3241e87ff0c1aa399de9bc6_JaffaCakes118
.dll windows:4 windows x86 arch:x86

db60e95411932452d204599bda9be255

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
LoadLibraryA
DisableThreadLibraryCalls
Sleep
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount
FindClose
FindFirstFileA
CreateProcessA
FreeLibraryAndExitThread
GetModuleFileNameA
CloseHandle
ReadFile
GetFileSize
CreateFileA
ExpandEnvironmentStringsA
HeapAlloc
GetProcessHeap
VirtualAlloc
VirtualProtect
VirtualFree
IsBadReadPtr
HeapFree
FreeLibrary

user32

wsprintfA

msvcrt

_initterm
_beginthread
_mbsstr
??2@YAPAXI@Z
realloc
free
malloc
_adjust_fdiv

Exports

Exports

DllGetClassObject
GetCatalogObject2
profapi_104

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 596B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ