d1cc4d634d065444f4c64dcac7412c00_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d1cc4d634d065444f4c64dcac7412c00_JaffaCakes118
Size

44KB
MD5

d1cc4d634d065444f4c64dcac7412c00
SHA1

773917163b8b980bf28992c5782f62da8b0b411e
SHA256

1fcc93000e863c2b7d5246e59f0c488d4c1cb10508c4b7a6cc9b2fad749e5b04
SHA512

d3dccb7dead4406c3c4fe99521635fac16b5856773a77dcb3e9a4fee536b440cdfd2f8b027e844fb0bbf49ab6eef54a2fdb26d558ade85c60362f4f2336a37a6
SSDEEP

768:nmO7BX4wZdQeM1G02Ons0tLZzKYzor0JQBw3o:nvBXiE0P7BKYzHcw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d1cc4d634d065444f4c64dcac7412c00_JaffaCakes118

Files

d1cc4d634d065444f4c64dcac7412c00_JaffaCakes118
.dll windows:4 windows x86 arch:x86

4aa321694eb630435db7a48e7d4e6a7a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

strcpy
_wcsnicmp
_strlwr
strcmp
RtlImageDirectoryEntryToData
RtlImageNtHeader
memcpy
strstr
sprintf
strncpy
memset
strcat
strlen
_strnicmp
wcsstr
_wcslwr
_chkstk

kernel32

VirtualProtect
LoadLibraryA
OutputDebugStringA
HeapFree
HeapReAlloc
HeapAlloc
HeapCreate
VirtualFree
VirtualAlloc
SetUnhandledExceptionFilter
ExitThread
GetCommandLineA
GetTempFileNameA
MoveFileExA
DeleteFileA
CloseHandle
GetModuleHandleA
GetVersionExA

Sections

.text
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ