cfa0d1be13bf62eacb0e3ec044b59fc7_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cfa0d1be13bf62eacb0e3ec044b59fc7_JaffaCakes118
Size

68KB
MD5

cfa0d1be13bf62eacb0e3ec044b59fc7
SHA1

2f92f800f573f447955cf3b1d4278bab778db7a9
SHA256

b5165f6d7e935217aadeadfbaf06a9bbf4d2351ea1c203cde811fa329cc621b3
SHA512

709a2de30612b7f74758b834933d2dd2523bf12f063c4ce0ee71f74954777bf540d75bac18bb6ab012c923bb786898f6044821245fa08e4cceca8519f5190801
SSDEEP

1536:IRhiX3KfIO2nToIf/2TpPyVwPtd2UZEZcsl2D4:ITiniiTBf/wPAAtdktY8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cfa0d1be13bf62eacb0e3ec044b59fc7_JaffaCakes118

Files

cfa0d1be13bf62eacb0e3ec044b59fc7_JaffaCakes118
.dll windows:4 windows x86 arch:x86

d3a92cb5dc15fa07cab9620382ce8c6a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DisableThreadLibraryCalls
ExitProcess
lstrcmpiA
VirtualAlloc
IsBadReadPtr
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA

user32

TranslateMessage
DispatchMessageA
GetMessageA
SetTimer
KillTimer
SendMessageA
LoadCursorA
RegisterClassExA
CreateWindowExA
DefWindowProcA
LoadIconA

msvcrt

_adjust_fdiv
_initterm
free
malloc

Exports

Exports

start

Sections

.text
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 606B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ