da4d2552e3277e1b8d08a7ee6f99e33f_JaffaCakes118 | Triage

Sharing

General

Target

da4d2552e3277e1b8d08a7ee6f99e33f_JaffaCakes118
Size

8KB
MD5

da4d2552e3277e1b8d08a7ee6f99e33f
SHA1

28667a250ed30fdfedd6731a9a6eeac39c28507c
SHA256

cc4fb1537f1f4c93af35bdb8071fb5d3e56705b2de12c1277381b670683f909a
SHA512

041ab5e7fc9d0f5dc9665bf0e8909ef7c2e26d9cb38ff52823b07b952512da34ce20316462ce97973a00d53c467135519722136a6c3e70576a379e8f8c742b18
SSDEEP

96:V3HGiM4fZkdwETQw8QJ2L2tghbio9WbbhLDXVFafkNiV:VXGihZUdFLNnXmDV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
da4d2552e3277e1b8d08a7ee6f99e33f_JaffaCakes118

Files

da4d2552e3277e1b8d08a7ee6f99e33f_JaffaCakes118
.dll windows:4 windows x86 arch:x86

f58222c9342e88ed645abff1b7950589

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
Sleep
VirtualProtectEx
WideCharToMultiByte
ReadProcessMemory
GlobalLock
GlobalAlloc
IsBadReadPtr
GetCurrentProcess
CreateThread
GlobalFree
GetModuleFileNameA

user32

CallNextHookEx
SetWindowsHookExA

wininet

InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA

msvcrt

_adjust_fdiv
malloc
_initterm
_stricmp
free
strrchr
??3@YAXPAX@Z
strcpy
??2@YAPAXI@Z
sprintf
strlen
strncpy
strchr
strstr
fclose
fread
fopen
memset
memcpy
strcmp

Exports

Exports

fa
fc

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sdt
Size: 512B - Virtual size: 269B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ