bf167f1f764ddae508e8e595d6002eee_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bf167f1f764ddae508e8e595d6002eee_JaffaCakes118
Size

8KB
MD5

bf167f1f764ddae508e8e595d6002eee
SHA1

4b4f4ab694beead1773957f73b388415d26fa7db
SHA256

8fc539d0646603d69d5d38f60e9b757ab766d9234bfb7f21415ae615effcc1dc
SHA512

6f1065af79d32e9fd134ab90465fa7a9ddfbc910e1ef2ded458ee78f904ccf83bffdb1dffc470018254e0ee0edbaf15da8f8ecabf3e1e851da4fdf4b5286b9b1
SSDEEP

96:kaVeRtDeG8Ccml2ZOz90cdwHZyaKkIGqUdelRflvl:kaVeTDFtnKOzDaKpGqU8lL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bf167f1f764ddae508e8e595d6002eee_JaffaCakes118

Files

bf167f1f764ddae508e8e595d6002eee_JaffaCakes118
.dll windows:4 windows x86 arch:x86

95ab8a47e1090389183ed659a1b1ae5b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
lstrcpyA
lstrlenA
Sleep
FindNextFileA
DeleteFileA
FindFirstFileA
VirtualFree
VirtualAlloc
lstrcatA
GetModuleHandleA
CreateProcessA
ReadFile
GetFileSize
OpenFile
OutputDebugStringA
LoadLibraryA
CreateThread
DisableThreadLibraryCalls
GetModuleFileNameA
GetTempPathA
CloseHandle
GetEnvironmentVariableA

Exports

Exports

LpkDllInitialize
LpkDrawTextEx
LpkEditControl
LpkExtTextOut
LpkGetCharacterPlacement
LpkGetTextExtentExPoint
LpkInitialize
LpkPSMTextOut
LpkTabbedTextOut
LpkUseGDIWidthCache
ftsWordBreak

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 966B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ