f522717fdb6f01902aedbf0c4205e7df_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f522717fdb6f01902aedbf0c4205e7df_JaffaCakes118
Size

10KB
MD5

f522717fdb6f01902aedbf0c4205e7df
SHA1

6a03a701186f2b654e28b549642a60cf7a1f1c15
SHA256

d09b5744ec051c93f3531a390caa54423927fde114d32c162bcf81d118d0b7c9
SHA512

616ee3b647e4b3a27ceabd599e32d905b36e78ab1a7e7a2eb937ff68407b74dfa457bbbbfa0220d5d4cc05a894f3e1ee9161453bf8645155d59a5b8b22257a8f
SSDEEP

192:sXDhGcmHmUkeQEwLD4evg6HEM4XiJk+v7LowXt:sXDhQHmU7Q5PP/vkiJ/vw+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f522717fdb6f01902aedbf0c4205e7df_JaffaCakes118

Files

f522717fdb6f01902aedbf0c4205e7df_JaffaCakes118
.dll windows:4 windows x86 arch:x86

bd34be4aa46cb250faa4ebf0f973857e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WideCharToMultiByte
IsBadReadPtr
GetPrivateProfileStringA
Sleep
CreateThread
WriteProcessMemory
GlobalFree
GlobalLock
GlobalAlloc
GetModuleFileNameA
GetCurrentProcess
ReadProcessMemory

user32

SetWindowsHookExA
CallNextHookEx

wininet

InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetCloseHandle

msvcrt

_adjust_fdiv
_stricmp
malloc
_initterm
free
??3@YAXPAX@Z
strrchr
memcpy
strcpy
strlen
sprintf
??2@YAPAXI@Z
memset
fclose
fread
fopen

Exports

Exports

fx

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sdt
Size: 512B - Virtual size: 269B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 766B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ