da4f10899df4e7d70c51cf9ccaf01bd4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

da4f10899df4e7d70c51cf9ccaf01bd4_JaffaCakes118
Size

11KB
MD5

da4f10899df4e7d70c51cf9ccaf01bd4
SHA1

11591749ec002e8cd63d38f29d0ecbd8592bc20d
SHA256

352b4b3b3b089737a4b56992bbb40d40ebaead29e1432964539ee3b5dcc2f91c
SHA512

6bbc31e3c84e20e8046b8c89c121a3b6826ae1500e98dea2a4ab21075556f20e964bc39bd421c3cd78248867f6c243eedf465a311a3a0837ff48a8ddac85d35b
SSDEEP

192:DlihwoRqtg+C7Q7UUnKK5f43daiWSswP1gIDCw2SLXW9jd4Mb:Dlihet77UaKgQIiRt95ycM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
da4f10899df4e7d70c51cf9ccaf01bd4_JaffaCakes118

Files

da4f10899df4e7d70c51cf9ccaf01bd4_JaffaCakes118
.dll windows:4 windows x86 arch:x86

5a04821d2e95c570c52c797041770fe2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CompareStringA
IsBadReadPtr
LoadLibraryA
GetModuleFileNameA
GetProcAddress
lstrlenA
MultiByteToWideChar
CreateThread
GetTickCount
GetCurrentProcessId
VirtualProtect
GetProcessHeap
HeapAlloc

user32

CallNextHookEx
wsprintfA
SetTimer
KillTimer
GetMessageA
DispatchMessageA
SetWindowsHookExA
UnhookWindowsHookEx

msvcrt

strchr
strncmp
__CxxFrameHandler
_local_unwind2
strstr
strrchr
_except_handler3
wcslen
_wcsnicmp
strncpy

shlwapi

StrCmpNIA

oleaut32

VariantClear
SysAllocString

ole32

CoUninitialize
CoCreateInstance
CoInitialize

wininet

InternetOpenUrlA
InternetReadFile
InternetCloseHandle
InternetOpenA

ws2_32

ntohs
getpeername

Sections

.text
Size: 7KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 882B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ