d1a22a0317e834805d733c58f9aa5b6c_JaffaCakes118 | Triage

Sharing

General

Target

d1a22a0317e834805d733c58f9aa5b6c_JaffaCakes118
Size

28KB
MD5

d1a22a0317e834805d733c58f9aa5b6c
SHA1

c11d8a3b64bc3e809761b7a47b7cbbde479cec2b
SHA256

6251981a8e15c1383b1bbd8fb1be78bfc9d45cd24df2f3110bbcb66a08e36a88
SHA512

1feda1b2d6e209d28c215fc394bc30d679b6ddf33b4634461d6368497b893f0335e85e63e2ad52be20af11a251c119a07414ae126e1c0682e6d8693f70c6b0cd
SSDEEP

384:DU9GxW3hhj1kxwWjaWnCv/Rf4p5CXMPnIIt0UT:DU9yghE7j/m/RAScfIg0UT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d1a22a0317e834805d733c58f9aa5b6c_JaffaCakes118

Files

d1a22a0317e834805d733c58f9aa5b6c_JaffaCakes118
.dll windows:4 windows x86 arch:x86

c7cc7e9a3ac25a96810edc983a29c24f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcess
GetProcAddress
LoadLibraryA
WideCharToMultiByte
MultiByteToWideChar
CreateEventA
CreateThread
FlushInstructionCache
VirtualProtectEx
Sleep
IsBadReadPtr
lstrlenA
SetEvent
lstrcpyA
TerminateProcess
WaitForSingleObject
SetLastError
VirtualProtect
GetModuleFileNameA

user32

MessageBoxA
SetWindowsHookExA
CallNextHookEx

wininet

InternetCloseHandle
InternetOpenA
InternetReadFile
InternetOpenUrlA

advapi32

RegCreateKeyA
RegSetValueExA

msvcrt

_EH_prolog
_adjust_fdiv
malloc
_initterm
free
puts
strrchr
strstr
memcpy
sprintf
strlen
strcmp
_except_handler3
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
_stricmp
memset
strcpy

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ