f0b16035b7bb61e620ad664e06775de2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f0b16035b7bb61e620ad664e06775de2_JaffaCakes118
Size

84KB
MD5

f0b16035b7bb61e620ad664e06775de2
SHA1

8e7d96d0af5319401f5c47e72d6849ddd345cc7a
SHA256

d036d55ef28c23f380bdcd44cbb0b4ee3889a5218587001d20399be44a92d194
SHA512

dcc05480981e47c7ae9045247345d2e909ce45fe0b68d196fef135247d77a8967603f5c90a508209fbd3980f35bd1f63f03f51c4c1a52c09977b99406a8a0a73
SSDEEP

1536:SpKO1iH1MqqU+NV23S2TLo6CJcRt6ctVGqvUo85/Zoc:SSVMqqDLy/g6CaT6cmqY/Zoc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f0b16035b7bb61e620ad664e06775de2_JaffaCakes118

Files

f0b16035b7bb61e620ad664e06775de2_JaffaCakes118
.dll windows:4 windows x86 arch:x86

b2fac6ed4714cc0f8b030914f2de771f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

InitializeCriticalSectionAndSpinCount
CreateEventW
CloseHandle
SetEvent
InterlockedDecrement
InterlockedIncrement
Sleep
GetTickCount
FreeLibraryAndExitThread
GetCommandLineA
GlobalMemoryStatus
GetSystemInfo
PostQueuedCompletionStatus
GetQueuedCompletionStatus
OutputDebugStringA
DisableThreadLibraryCalls
InterlockedExchange
InterlockedCompareExchange
CreateThread
VirtualProtect

advapi32

RegQueryValueExW

msvcrt

_except_handler3
__CxxFrameHandler
_adjust_fdiv
memset
_amsg_exit
_initterm
free
malloc

Sections

.text
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 942B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ