bba8aaed0b7e6efeba55095742932f74_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bba8aaed0b7e6efeba55095742932f74_JaffaCakes118
Size

71KB
MD5

bba8aaed0b7e6efeba55095742932f74
SHA1

8741a8c0e218e70d05cf3fcb04d085b3405dfe4d
SHA256

a460882f84cad5dce1fd4bb68b9f2c31d4fd16ca7bf405a0ac39ac25cfe7bf6f
SHA512

5c9b772183750daab2f4e19e102b31943091506ac5ad6ee950eabcf1e1fc2c89daa8fc3f5d16cf6da2da6e8d374343e943b151163e740895595474f526d7dfb9
SSDEEP

1536:YD7jQuJl5hfTFt9i9ZKE/oWvnWdhhajMO5aJWypve3DE91Rmj1SiZD:e9CKE/jWdhhaYxJW1Egj1SMD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bba8aaed0b7e6efeba55095742932f74_JaffaCakes118

Files

bba8aaed0b7e6efeba55095742932f74_JaffaCakes118
.dll windows:4 windows x86 arch:x86

946a5c3d9d1f8e65a51d73020a599993

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

msvcrt

_vsnprintf

wsock32

connect

gdi32

DeleteObject

user32

UnhookWindowsHookEx

Exports

Exports

CancelDll
LoadDll

Sections

.text
Size: 15KB - Virtual size: 6.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE