bc2360437d78f6f219b799c2b1c4a6b6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bc2360437d78f6f219b799c2b1c4a6b6_JaffaCakes118
Size

18KB
MD5

bc2360437d78f6f219b799c2b1c4a6b6
SHA1

d3b080cc73ac3da2993b8b97b6c1609b7cc6369e
SHA256

007603654372e0c578c9818525b306c24bfdcb327f704f8d973b34adf78a9ef3
SHA512

dd6435cef6f8feb5d7ee01b7d9f819dc3951ed400cc21d3fb535d49e3b0b59fb83149b3ddd8d95a32a8e572183e1ca63158b667d0109f6a5c8f2dcfec0ec7b81
SSDEEP

384:cYnAskrEqkk6lauQkdn/T+yTjC5eAbBlFdSOG:ce/CvuQkd/T+yQ1oO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bc2360437d78f6f219b799c2b1c4a6b6_JaffaCakes118

Files

bc2360437d78f6f219b799c2b1c4a6b6_JaffaCakes118
.dll windows:5 windows x86 arch:x86

22579fb83f53185cdd3c3beb64e73d61

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

ZwCreateEventPair
ZwSetHighWaitLowEventPair
ZwWaitHighEventPair
ZwDelayExecution
ZwSetLowEventPair
swprintf
RtlExitUserThread
wcscpy
wcscat
ZwTerminateProcess
ZwWaitForSingleObject
ZwClose
ZwResumeThread
ZwSetContextThread
ZwWriteVirtualMemory
ZwAllocateVirtualMemory
RtlInitUnicodeString
wcslen
RtlPrefixUnicodeString
RtlGetCurrentPeb
ZwAlertThread
memcpy
memset

kernel32

Sleep
CreateThread
IsDebuggerPresent
SetInformationJobObject
CreateJobObjectW
AssignProcessToJobObject
CreateProcessW
LocalFree
LocalAlloc
VirtualFree

cabinet

ord22
ord20
ord23

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ