d155982bb9f91fd9ab97e2715898d646_JaffaCakes118 | Triage

Sharing

General

Target

d155982bb9f91fd9ab97e2715898d646_JaffaCakes118
Size

48KB
MD5

d155982bb9f91fd9ab97e2715898d646
SHA1

bfcf73e8322ebc330597f6923f36dcd526d2f7e8
SHA256

2fac047177e903dd8752b3dd62ee81c931f331f4f37495d4c67e8f62d5fc6b97
SHA512

ec9620781f2c83be40cb9d5e5b136d9d46e59eed345fda26e1d02b34959742f0a7c1efb836deb06d2285266de51b35dabe3df2c630ea3a143a39924a1e452721
SSDEEP

768:N4wuca2fuVrgDtcis/tyV/++XaQS1ws7m/uT8AoL601H9TZ:NZJa2GVr8yh/MV/pXcmmTLkL1H1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d155982bb9f91fd9ab97e2715898d646_JaffaCakes118

Files

d155982bb9f91fd9ab97e2715898d646_JaffaCakes118
.dll windows:4 windows x86 arch:x86

4eaa6a39019fdde8ba1831059dc3318b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

syncaback.pdb

Imports

kernel32

FreeLibrary
LoadLibraryW
InterlockedIncrement
InterlockedDecrement
lstrcpyW
CloseHandle
MulDiv
SetEvent
MultiByteToWideChar
GetCurrentThreadId
GetProcAddress
GlobalAlloc
LoadLibraryA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
CreateEventW
GetTickCount
GetTempPathW
GetTempFileNameW
CopyFileW
ReadFile
GetFileAttributesW
CreateFileW
WriteFile
GlobalFree
DeleteFileW
ResetEvent
GetLocalTime
lstrcatW
GetUserDefaultLCID
GetCurrentDirectoryW
FormatMessageW
LocalFree
lstrcmpW
GetModuleHandleA
QueryPerformanceCounter
lstrlenW

advapi32

IsValidSid

msvcrt

exit

Exports

Exports

szdnqys

Sections

.text
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 498B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ