f6a6a046a994fa223970268c79b8d1c1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f6a6a046a994fa223970268c79b8d1c1_JaffaCakes118
Size

68KB
MD5

f6a6a046a994fa223970268c79b8d1c1
SHA1

a93b4028cd7ea432da4fd00c1d4ebfe6246bc495
SHA256

089e6f1c4695964e19e3452525a27cb11ca8fa3ef36fff9506312f119fcc0623
SHA512

d2729a818bead92e5a9d0d606e18321799884f92bfdaba71e3f8704a9ab554b717093de35d1e037657017f7ef92af567ebeb4986808d0795162b1de22fe80184
SSDEEP

1536:eq4vR0WFckIKidg2fl/wWbesHFfhZVPiFjkYNZ1:iWKL87RTLiFjkYNZ1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f6a6a046a994fa223970268c79b8d1c1_JaffaCakes118

Files

f6a6a046a994fa223970268c79b8d1c1_JaffaCakes118
.dll windows:4 windows x86 arch:x86

70a0452ca6ff4be9ea53371fd46c80bc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
DeleteCriticalSection
InitializeCriticalSection
HeapDestroy
lstrlenA
MultiByteToWideChar
lstrcpynA
lstrcmpiA
GetVersion
GetCommandLineA
VirtualProtect
DisableThreadLibraryCalls

user32

CharNextA

advapi32

RegDeleteValueA
RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegCreateKeyExA

ole32

CoTaskMemFree

msvcrt

_initterm
rand
localtime
time
_except_handler3
_adjust_fdiv
free
malloc
_ftol

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ