f66245a350326f7e7ef8e065f38a59be_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f66245a350326f7e7ef8e065f38a59be_JaffaCakes118
Size

5KB
MD5

f66245a350326f7e7ef8e065f38a59be
SHA1

ceb3f27dfe76f3e9a937fd0812d2f651af7f0e0f
SHA256

1350e4219d0a8bbe286c156e289cce190ea938c1f3fb44b7a2aa9a6f768eb306
SHA512

6766763bfc9b645fbf7fdebb847ebbefdb2686cea294e8845cd0830c4a6e918cb1e4d883439a7fc35e1890963e34c0b411899f213c92c6450613f531bad783c5
SSDEEP

96:YHiz76eLbqL/IKbO1pJFDdFfs9Ac5C1eAnvOv/g:OiX5LkI1VdjnvU/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f66245a350326f7e7ef8e065f38a59be_JaffaCakes118

Files

f66245a350326f7e7ef8e065f38a59be_JaffaCakes118
.dll windows:4 windows x86 arch:x86

52956d2fa82c7d70601a0bbfd0f286b0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

InternetCloseHandle
InternetOpenA
InternetReadFile
HttpQueryInfoA
InternetOpenUrlA

msvcrt

_strlwr
_adjust_fdiv
malloc
_initterm
free
isalnum
rand
??3@YAXPAX@Z
strstr
srand
??2@YAPAXI@Z
_snprintf

kernel32

GetSystemDirectoryA
TerminateThread
CreateThread
LoadLibraryA
GetModuleFileNameA
Sleep
GetTickCount
ExitProcess
DeleteFileA
WinExec
CloseHandle
WriteFile
CreateFileA

user32

CallNextHookEx
SetWindowsHookExA

advapi32

RegDeleteValueA
RegSetValueExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA

Exports

Exports

?SetHook@@YGXXZ

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ