e249fa50914a720c5d40f12af7f2fd4b_JaffaCakes118 | Triage

Sharing

General

Target

e249fa50914a720c5d40f12af7f2fd4b_JaffaCakes118
Size

48KB
MD5

e249fa50914a720c5d40f12af7f2fd4b
SHA1

ef07e0c3df4eb9fc5d3a6c61c9b023a8a37cab53
SHA256

9d58f4ed4a4f0e637babf12108d77ce2be69ef0b484d0647259a1d99bdb626eb
SHA512

8b2357686ccaae10745ab3002f37a0aca44d0135bcada2daf0d295745d4e7538f4f2aeaf6ed3abc61c60aeb9b9dd70fd9c6127cbabb578b80b6a5c54d69eecb6
SSDEEP

768:NpeHAhopqOC+wSlBDbohbqInxjJgHBkrlCwTtkZoHOM5e3glCy2HoFAly3:NQHAhFOw0ohbPZJgKTWqCyVJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e249fa50914a720c5d40f12af7f2fd4b_JaffaCakes118

Files

e249fa50914a720c5d40f12af7f2fd4b_JaffaCakes118
.dll windows:4 windows x86 arch:x86

4eaa6a39019fdde8ba1831059dc3318b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

niinihte.pdb

Imports

kernel32

FreeLibrary
LoadLibraryW
InterlockedIncrement
InterlockedDecrement
lstrcpyW
CloseHandle
MulDiv
SetEvent
MultiByteToWideChar
GetCurrentThreadId
GetProcAddress
GlobalAlloc
LoadLibraryA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
CreateEventW
GetTickCount
GetTempPathW
GetTempFileNameW
CopyFileW
ReadFile
GetFileAttributesW
CreateFileW
WriteFile
GlobalFree
DeleteFileW
ResetEvent
GetLocalTime
lstrcatW
GetUserDefaultLCID
GetCurrentDirectoryW
FormatMessageW
LocalFree
lstrcmpW
GetModuleHandleA
QueryPerformanceCounter
lstrlenW

advapi32

IsValidSid

msvcrt

exit

Exports

Exports

bgcrz

Sections

.text
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 508B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ