eb8db5a63cbd8c82a7fa3ae645109b01_JaffaCakes118

General

Target

eb8db5a63cbd8c82a7fa3ae645109b01_JaffaCakes118
Size

8KB
MD5

eb8db5a63cbd8c82a7fa3ae645109b01
SHA1

bb5bbbf33b223f0750ce7abed2cecc505d9f3fda
SHA256

58a1174aefcdb129897769a1bd0c43f2324ce58287a53f05b180ffed9dc2c68c
SHA512

3bc250c166bc03c546e082cb80e12296690a65d5b0a4288f6a244b52ca36803a0d6f0afb69d2e4f756b011d582c79ed2f66e39c38cc954f479c23d2367abd21c
SSDEEP

96:SvYfq01CeWYz+x+mVlc2Yb/TPAf3X3X3fflHf/3tns3JPH8FixzO1O:/q01CJYz+xdYTYnF/dnUPDzO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eb8db5a63cbd8c82a7fa3ae645109b01_JaffaCakes118

Files

eb8db5a63cbd8c82a7fa3ae645109b01_JaffaCakes118
.dll windows:4 windows x86 arch:x86

8db61b965045f625b2dc5cbc6304e6cf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

msvcrt-ruby191

onigenc_always_true_is_allowed_reverse_match
onigenc_apply_all_case_fold_with_map
onigenc_get_case_fold_codes_by_str_with_map
onigenc_is_mbc_newline_0x0a
onigenc_minimum_property_name_to_ctype
onigenc_not_support_get_ctype_code_range
onigenc_single_byte_code_to_mbc
onigenc_single_byte_code_to_mbclen
onigenc_single_byte_left_adjust_char_head
onigenc_single_byte_mbc_enc_len
onigenc_single_byte_mbc_to_code
rb_enc_register

kernel32

AddAtomA
FindAtomA
GetAtomNameA
VirtualProtect
VirtualQuery

msvcrt

__dllonexit
_assert
_errno
_iob
abort
fflush
free
fwrite
malloc
memcpy
memset
vfprintf

Exports

Exports

Init_iso_8859_15

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 212B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 82B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8db61b965045f625b2dc5cbc6304e6cf

Headers

File Characteristics

Imports

msvcrt-ruby191

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 3KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 1KB

.bss Size: - Virtual size: 212B

.edata Size: 512B - Virtual size: 82B

.idata Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 284B

.text
Size: 3KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 1KB

.bss
Size: - Virtual size: 212B

.edata
Size: 512B - Virtual size: 82B

.idata
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 284B