decce5f781ca79208f554737edd8e6c6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

decce5f781ca79208f554737edd8e6c6_JaffaCakes118
Size

15KB
MD5

decce5f781ca79208f554737edd8e6c6
SHA1

a4d8642252d01ad7bc9334d025cd0c459f4f9b00
SHA256

ce7a7fccb7dbc17d027df2b4eb374c573ac71c8264bb4b643f26ee03487d3f22
SHA512

269fd69b57508bfb77743f673f9340a3fb9cd56fe0d8146eb80dca325bf99e5e394515dde37a6e48b6d2c2fb39e9c086ec37e348ef5d18c84326b9a8d4efb717
SSDEEP

192:QOdWqI/4y+09talN9rg+AraWeLIEgdR21si9zHJQEqFCGZfVUH9CzT9lK:HXJEa7hW1eLIEgb2Ci8Z7UdCd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
decce5f781ca79208f554737edd8e6c6_JaffaCakes118

Files

decce5f781ca79208f554737edd8e6c6_JaffaCakes118
.dll windows:4 windows x86 arch:x86

980e242cb8d9baa7aa8713876ef43478

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OutputDebugStringA
GlobalAlloc
GlobalFree
GetProcAddress
LoadLibraryW
ExpandEnvironmentStringsW
WideCharToMultiByte
lstrcmpA
GetCurrentProcessId
lstrlenA
LoadLibraryA
WriteFile
CloseHandle
CreateFileA
lstrcpyA
lstrcatA
GetSystemDirectoryA
FreeLibrary
Sleep
CreateThread
GetModuleFileNameA
HeapAlloc
GetProcessHeap

ws2_32

WSCEnumProtocols
WSCGetProviderPath

user32

wvsprintfA
GetClassNameA
GetWindowThreadProcessId
EnumWindows
wsprintfA
CharLowerBuffA

Exports

Exports

WSPStartup

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 754B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ