dd6f222c2b412368ce3fd75ef38d4cc2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dd6f222c2b412368ce3fd75ef38d4cc2_JaffaCakes118
Size

40KB
MD5

dd6f222c2b412368ce3fd75ef38d4cc2
SHA1

b880168d1501c1454ab2e8efb6e61b84e7c2748b
SHA256

eca96979ef6b9b0a3c3920371313c0a8ecd6c650186da26267540e9e4b0b12d2
SHA512

f6a71c37e829e130e9d57d0b39877666aa91e325c9f5b51e035d5c1dda8cd59b248952bd4fcc1440bea4a1546b70c4fcda40300619a1f08d704bd56fd531c923
SSDEEP

768:AWd2oGZq9QQw7nKV8MWtd8h/dozx9fOVCT:AWjGZqblVid8bQECT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dd6f222c2b412368ce3fd75ef38d4cc2_JaffaCakes118

Files

dd6f222c2b412368ce3fd75ef38d4cc2_JaffaCakes118
.dll windows:4 windows x86 arch:x86

824b6ef12e8b266f778218a0e88daf31

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

strcpy
_wcsnicmp
wcsstr
_wcslwr
_strlwr
strcmp
RtlImageDirectoryEntryToData
RtlImageNtHeader
RtlEqualUnicodeString
memcpy
strstr
sprintf
strncpy
memset
strcat
strlen
RtlGetCurrentPeb
_strnicmp
_chkstk

kernel32

Sleep
HeapFree
HeapReAlloc
HeapAlloc
HeapCreate
VirtualFree
VirtualAlloc
DeleteCriticalSection
TerminateThread
CreateThread
GetLastError
CreateMutexA
InitializeCriticalSection
LoadLibraryA
GetModuleHandleA
GetModuleFileNameA
DisableThreadLibraryCalls
CreateFileA
GetFileSize
ReadFile
CloseHandle
WriteFile
GetTempPathA
DeleteFileA
GetSystemDirectoryA
MoveFileA
LeaveCriticalSection
EnterCriticalSection
VirtualProtect
WideCharToMultiByte
MultiByteToWideChar

Sections

.text
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ