cdf5833b0a49c49150c8a31518cd252b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cdf5833b0a49c49150c8a31518cd252b_JaffaCakes118
Size

5KB
MD5

cdf5833b0a49c49150c8a31518cd252b
SHA1

a41cc45c46ca616986ae510f15a953f9227d6ccb
SHA256

4c7de6298e5205b48045cf63cfd8c110f18dfec96e7c9fee0ee19750c3ba488c
SHA512

6717cb82c3386f095beb7b44d05c6f96f9e4fd7bb75c4ddb9aaa7f7e6bc13cc6adcb88d8e096108e632d8d13c7971f8b4ae5f541ac03a31de11b0cc4b9a53996
SSDEEP

96:QycAm31dhY/S0o9kDV3V7MqcagJosJobk6l3k:H3/TYoNlNJbTl3k

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cdf5833b0a49c49150c8a31518cd252b_JaffaCakes118

Files

cdf5833b0a49c49150c8a31518cd252b_JaffaCakes118
.dll windows:4 windows x86 arch:x86

00ef7ad842b092a1152f9d2981d84ffe

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

strncmp

user32

FindWindowExA
FindWindowA
CallNextHookEx
wsprintfA
GetWindowThreadProcessId
SetWindowsHookExA

kernel32

CreateThread
lstrcpyA
lstrcmpiA
VirtualProtect
TerminateProcess
Sleep
RtlMoveMemory
OpenProcess
ExitProcess

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 518B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 236B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ