ea798bc1750328217dbc3d9b2553c02c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ea798bc1750328217dbc3d9b2553c02c_JaffaCakes118
Size

71KB
MD5

ea798bc1750328217dbc3d9b2553c02c
SHA1

6982dec3a519af286284862ed2691b1afdc3afb1
SHA256

819d2b191cec8103959baf4c337c6b09d4df6415d46225eaca53d6e0707caf56
SHA512

4a1005f2052670022a9781301b0d99dd5d09009b0850be54c69dd6cbdd3a758a3eee8982cc6ac7dda2551e5fcb880293be241591cd04940779b409ce201b94d8
SSDEEP

768:A9AapuWmVK9lfnUSCQDfF1oSEaDlsGDFVadBwk13mY9kfwr2c/ocQt:AZwFVIqtQbFWSjOg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ea798bc1750328217dbc3d9b2553c02c_JaffaCakes118

Files

ea798bc1750328217dbc3d9b2553c02c_JaffaCakes118
.dll windows:9 windows x86 arch:x86

b90cae5398e45769a8b6a88b14be0e17

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

ShowWindow

kernel32

VirtualAlloc
RtlMoveMemory
MultiByteToWideChar
lstrlenA
lstrcmpiA
lstrcmpA
GetModuleHandleA
GetModuleFileNameA
GetCommandLineW
GetCommandLineA
GetACP
ExitProcess

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 415B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 221KB - Virtual size: 337KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 517B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ