cf8f6201d242a9416d46bbf64f1121b4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cf8f6201d242a9416d46bbf64f1121b4_JaffaCakes118
Size

34KB
MD5

cf8f6201d242a9416d46bbf64f1121b4
SHA1

5d2acb5cb551cdb0899b5577094df8d85cdc30d5
SHA256

a631ba3368e91e824b518a912863ee0168c10a944d6d2a266dd99010403ddced
SHA512

b9b5c9137262937bc8c6f9ff92295b0876a43586c0d930f9a5a9b451df42b2839a9ff5d78059ec890e3bdc6c053e9a375566005f7405cbfe257cb090efcd4803
SSDEEP

768:mSXoLG3BSDXEmAFLlvTVmPfkGC+7Wql+3:sLG3Bpmkl7V63C+c3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cf8f6201d242a9416d46bbf64f1121b4_JaffaCakes118

Files

cf8f6201d242a9416d46bbf64f1121b4_JaffaCakes118
.dll windows:4 windows x86 arch:x86

bba65161cccbf2149051cde7b0c2b300

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenA
lstrcpyA
CloseHandle
lstrcatA
WriteFile
VirtualProtect
Sleep
MultiByteToWideChar
LoadLibraryA
GlobalFree
GlobalAlloc
GetTickCount
GetTempPathA
GetTempFileNameA
FlushFileBuffers
CreateFileA

Exports

Exports

proc1

Sections

.text
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 544B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ