dc62535fe0a3f6d31f652f29fdda7d28_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dc62535fe0a3f6d31f652f29fdda7d28_JaffaCakes118
Size

87KB
MD5

dc62535fe0a3f6d31f652f29fdda7d28
SHA1

62a1492ccc31ddbb1baf4bde96f0738dc0a5a939
SHA256

69bba72da43e3d5d7a868c3e4638ba6257bf33315cc7d08dd46fb57ca4502ac2
SHA512

ecd9d9126e5202406e95289e37d06a9aefb1540001ed429c39ed1ee5adc3f15eeeecc9190020766e69874c1dae1426be142fad9956f5a4a488cc6cd072d01780
SSDEEP

768:qMiWY5VYpy/kSVOz4n7vtrNxDREk27uzHAAjvZvTNSdD:Ni+yL0zItRJ75lT4d

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dc62535fe0a3f6d31f652f29fdda7d28_JaffaCakes118

Files

dc62535fe0a3f6d31f652f29fdda7d28_JaffaCakes118
.dll windows:4 windows x86 arch:x86

3d777ef5f71bc5aaedaf898c804465a9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateToolhelp32Snapshot
GetCurrentProcessId
lstrcmpW
Module32First
GetModuleHandleA
Module32Next
CloseHandle
lstrcpyW
lstrlenW
GetModuleFileNameW
HeapAlloc
WriteProcessMemory
GetCurrentProcess
VirtualProtect
IsBadStringPtrA
lstrcmpiA
GetProcessHeap

user32

SetWindowsHookExA
wsprintfW
CallNextHookEx

advapi32

RegOpenKeyExW

Exports

Exports

Stranger

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 884B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shr
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 398B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ