d01772e2845a6a22da3d0bbfbe4666f2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d01772e2845a6a22da3d0bbfbe4666f2_JaffaCakes118
Size

67KB
MD5

d01772e2845a6a22da3d0bbfbe4666f2
SHA1

eb9c8ff89eb6fe06638041384e6209f25223a953
SHA256

0bc04c6810a3803a3393864fc9c9da7abe8f699e9ab3a7e094d9480b9072bfe5
SHA512

3fd5b32a4718988f668cdb87cf9b17d35c1dc3811b7ed21974912e534882d229525a613384846aa03fedc9782ee91df00febc4427f784708e1bbc35af89ae3f3
SSDEEP

1536:tv9uTC6xoWXO1AmKmQMuefzxYfKsZlLpboagBA8:GTDxoMUmfKsx/J

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d01772e2845a6a22da3d0bbfbe4666f2_JaffaCakes118

Files

d01772e2845a6a22da3d0bbfbe4666f2_JaffaCakes118
.dll windows:4 windows x86 arch:x86

994f61f0e7f3f826bca28c1cf77b2a82

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

niotinite.pdb

Imports

kernel32

QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
Sleep
GetModuleHandleW
GetModuleHandleA
GetProcAddress
GetLastError
OpenProcess
CreateRemoteThread
GetCurrentProcess
SetUnhandledExceptionFilter
CloseHandle
UnhandledExceptionFilter

user32

CheckMenuItem

advapi32

AdjustTokenPrivileges
OpenProcessToken

Exports

Exports

pfkfdqpiu

Sections

.text
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 534B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ