ce19ffcdad0977b406c54673568eb339_JaffaCakes118 | Triage

Sharing

General

Target

ce19ffcdad0977b406c54673568eb339_JaffaCakes118
Size

24KB
MD5

ce19ffcdad0977b406c54673568eb339
SHA1

1343e18db2b49fa63b9f0b8200e03a419252c9ff
SHA256

4659e85084d7cde514bc7624f58553fbac66a3d637570333cef91828fec14440
SHA512

3dbb6b3703851ddbbb198347810a9db80dbe9eb4ee5c11b94215d7a54fb6ad7e89c47e3c3daee30bd2517043dedc2478d9c247aff20c2661e9199cd24be6642f
SSDEEP

192:jJn3dPHlZaA4xdOHy2VfT0sFivP0U3rGKK/G5y+6GZoZ2paNg:jJNPnaLOPpT0scX0U3yNG/6Up

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ce19ffcdad0977b406c54673568eb339_JaffaCakes118

Files

ce19ffcdad0977b406c54673568eb339_JaffaCakes118
.dll windows:4 windows x86 arch:x86

8bc8868032a0b5230f2d86138aabeedd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

FindWindowA
GetWindowTextA

msvcrt

_adjust_fdiv
malloc
_initterm
free
strlen
atoi
memcpy
strstr
??3@YAXPAX@Z
??2@YAPAXI@Z
memset
_strlwr

kernel32

VirtualProtectEx
TerminateProcess
CreateThread
OutputDebugStringA
GetModuleHandleA
Sleep
LoadLibraryA
GetTempPathA
CopyFileA
GetProcAddress
GetModuleFileNameA
lstrlenA
lstrcatA
GetCurrentProcess
WriteProcessMemory
GetCurrentProcessId
ReadProcessMemory
lstrcpyA

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 876B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ