d9b6979c06f93c60ec60905a9ee45768_JaffaCakes118 | Triage

Sharing

General

Target

d9b6979c06f93c60ec60905a9ee45768_JaffaCakes118
Size

308KB
MD5

d9b6979c06f93c60ec60905a9ee45768
SHA1

c739b44ddac49440a35eba9fd2e089b3d1cac344
SHA256

37d778c9acc9f61dab150403a872ccf7bd7048c97d8ab0bf4ef67563a5d7c8f7
SHA512

cf767a58ceab65ae48af455b613735c6190900790be87e9a098eff86e8217781d1b0f2e1f1d4ff1951187795652edcc7629f8ede26f62791c5ae687ce3a2f7d5
SSDEEP

6144:lHLWp2VtUwrGhLNajhOV0hCPEH+FKeVsQWE3Q6G8t:lrxlWLojh20hCW+QeOQHE8t

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d9b6979c06f93c60ec60905a9ee45768_JaffaCakes118

Files

d9b6979c06f93c60ec60905a9ee45768_JaffaCakes118
.dll windows:4 windows x86 arch:x86

b476be43c29e49ae9f46c9fdf1288c5c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualProtect
VirtualAlloc
ExitProcess
VirtualFree
LoadLibraryA
GetProcAddress

user32

GetCursorPos

gdi32

LineTo

Sections

.text
Size: 231KB - Virtual size: 420KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.aspack
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ