b3df62bb21227431683b0ef65a7fa353_JaffaCakes118 | Triage

Sharing

General

Target

b3df62bb21227431683b0ef65a7fa353_JaffaCakes118
Size

11KB
MD5

b3df62bb21227431683b0ef65a7fa353
SHA1

1100804dcc23821943b883658ea18c67ccc07dc8
SHA256

dec728d579e2d9cdc1132f9935d3a0d2c1235d19d60c9b29054a22cfdfc6d32f
SHA512

40f92d9f7cc7a4f663c3422e332413ade2008e920c7859b6c6be0dc28c63278f48518984a4aaef873d63b06b4d9fc46712988e1db5bd5ae65191017aac5ad554
SSDEEP

192:/fJB9MBfR5m7YKy+CfNzHmgl5kJxxJUtXaETVM:/f7gkvUJmuRXaA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b3df62bb21227431683b0ef65a7fa353_JaffaCakes118

Files

b3df62bb21227431683b0ef65a7fa353_JaffaCakes118
.dll windows:4 windows x86 arch:x86

b19435f36d89568d60f6121b5e7780e5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\ma1\ma\direct\rubbish\dnloaerc\Release\dnloaderc.pdb

Imports

kernel32

FreeLibrary
GetProcAddress
LoadLibraryA
CloseHandle
SetFilePointer
GetFileSize
WriteFile
CreateFileA
GetSystemDirectoryA
HeapFree
DeleteFileA
ReadFile
HeapAlloc
GetProcessHeap
Sleep
GetLocalTime
CreateThread
GlobalAlloc
GlobalFree
LoadLibraryW
ExpandEnvironmentStringsW
WideCharToMultiByte
GetLastError
CreateEventA
GetModuleFileNameA

ws2_32

WSCGetProviderPath
WSCEnumProtocols

user32

wsprintfA

shell32

ShellExecuteA

Exports

Exports

WSPStartup

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 658B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ