da9a14a2f987cd4f2973d06f95f2cd52_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

da9a14a2f987cd4f2973d06f95f2cd52_JaffaCakes118
Size

23KB
MD5

da9a14a2f987cd4f2973d06f95f2cd52
SHA1

c47daeccc290f810a401d81454b01791a72695c1
SHA256

e4654d43bce396e24926b3dcb983a7b4b39d8e4433cea25306916181b1cf3306
SHA512

4ad2275738ecae4690769a2b4784182819abb3bdf234237813c76395def13c2b9e46876a7730d5a990873ae7852320d5d9577f852dd96209844ddc6da3df3320
SSDEEP

384:3BbxMuI7yzVKMytBWMAzBBOjcVODu+aONl1IJ3hIaMdnBZLR/tUSG16CTvCvAVtT:RbxMuI71+LucVcL5Nl1pHBXVUSclzU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
da9a14a2f987cd4f2973d06f95f2cd52_JaffaCakes118

Files

da9a14a2f987cd4f2973d06f95f2cd52_JaffaCakes118
.dll windows:4 windows x86 arch:x86

8a05fdb99f4366abd5a51986f054eb2e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

shlwapi

SHGetValueA

rasapi32

RasEnumDevicesA

iphlpapi

GetAdaptersInfo

user32

GetThreadDesktop

advapi32

CreateProcessAsUserA

Exports

Exports

EvtShutdown
EvtStartup
inst
run
tes

Sections

.text
Size: 10KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE