f58a1842c13ef84a292892fcacc9dab1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f58a1842c13ef84a292892fcacc9dab1_JaffaCakes118
Size

23KB
MD5

f58a1842c13ef84a292892fcacc9dab1
SHA1

ec12cdb2d49735b2c6824b39cabd3d324b707a43
SHA256

ed4b25538e21e33a4fea995528e23e72a5ddf9548c11d08bb6539742e4621d7b
SHA512

64bad6e5974844361a98c41a5b1b187c6b158d95796f91448984db65e21792f90ef66f2ec562da021d1a17af2e23abd2b72b8c2e0074cd57013603c4226ab8c7
SSDEEP

384:eYIo51Bz9Uv1W/hF+X5LGFLimTM28jTE8yf2I:nws+lELimTSjlI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f58a1842c13ef84a292892fcacc9dab1_JaffaCakes118

Files

f58a1842c13ef84a292892fcacc9dab1_JaffaCakes118
.dll windows:4 windows x86 arch:x86

09e6bee324746dc0091dfadc6f544b6d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

AddAtomA
CreateThread
DisableThreadLibraryCalls
ExitProcess
FindAtomA
GetAtomNameA
GetModuleFileNameA
GetModuleHandleA
IsBadReadPtr
IsBadWritePtr
VirtualProtect

msvcrt

_sleep
__dllonexit
_errno
abort
fflush
free
malloc
memcpy
strstr

user32

GetAsyncKeyState
MapVirtualKeyA
MessageBeep
MessageBoxA
keybd_event

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 176B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE