bad2e39e9ec4a602eb741edbfc5c113c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bad2e39e9ec4a602eb741edbfc5c113c_JaffaCakes118
Size

145KB
MD5

bad2e39e9ec4a602eb741edbfc5c113c
SHA1

d8dea19e15460df2e268ea8f0467151f3ca75ff2
SHA256

979dfe96bb1f48de8e823b50aa29393270e213ff3d898410228124675fe4928a
SHA512

b50fba3ef3593dc256b7f71f4c9b2c3dcfbf374f8b63fdaf4d1cf399f226d47904eeda8e7032107590cb5eac74f5d20188b1bcdce370aaa2b04c53794ae63b58
SSDEEP

3072:dDg6g7Ym1Waf2gz+DiwMirQUACpFiBvfosY8Nk0lsRyDGSD:dDE1W42pTVMCpUZfosdNgRn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bad2e39e9ec4a602eb741edbfc5c113c_JaffaCakes118

Files

bad2e39e9ec4a602eb741edbfc5c113c_JaffaCakes118
.dll windows:4 windows x86 arch:x86

897e9487a731842a52efb3e49533059f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
ExitProcess
FindResourceA
GetACP
GetCommandLineA
GetConsoleOutputCP
GetCurrentThread
GetCurrentThreadId
GetModuleHandleA
GetOEMCP
GetProcessAffinityMask
GetStartupInfoA
HeapAlloc
HeapCreate
HeapReAlloc
InterlockedDecrement
LCMapStringW
MultiByteToWideChar
QueryPerformanceCounter
RtlUnwind
SetLastError
SetUnhandledExceptionFilter
TlsGetValue
WaitForSingleObject

msvcrt

__getmainargs
__p__commode
__set_app_type
exit
fprintf
strspn
vswprintf
wcslen

user32

PostQuitMessage
GetUpdateRgn
GetSysColorBrush
CreateMenu
DrawTextA

ole32

CoTaskMemFree
CoFileTimeNow
CoCreateInstance
CLSIDFromString

Exports

Exports

ExtTextOutComplex

Sections

.text
Size: 94KB - Virtual size: 228KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ