fb54608396a35f1411f3a87fb3df7501_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fb54608396a35f1411f3a87fb3df7501_JaffaCakes118
Size

184KB
MD5

fb54608396a35f1411f3a87fb3df7501
SHA1

70a289c9dca3a1028f4c9a4068ec581210c9009b
SHA256

f6bd5cdb2433033b8f1c29acefed127ff51e4983297b91f6bb931664d760b1ab
SHA512

5a9e6195b9de7586e8fbf73c1b9fa78a43e7e8889678b65ef096720b6185c176fedff0ab7f382ed853ae185bf72cf378218991db949655eae7b7955c6ec8c846
SSDEEP

3072:fa2M8zzEyZv8hlxvh0RF7KNcRBiKzGBED4xgv9+sBoOOzR0zkBVhf1un7RFhLyC:SSftZUhlxqHRbiiD4xI+sjA2Eh6L

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fb54608396a35f1411f3a87fb3df7501_JaffaCakes118

Files

fb54608396a35f1411f3a87fb3df7501_JaffaCakes118
.dll windows:5 windows x86 arch:x86

1f949c9f2e3b00bff2f53f7a4e7cc0b8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

G:\zIcjlPhjxzaF\bdnqpMp\phUywTKEcuoHc\Okjstewe\vetNwQqlk.pdb

Imports

gdi32

PtInRegion
GetTextExtentPointA
RemoveFontResourceW
FillRgn
CreateCompatibleBitmap

kernel32

OpenFileMappingA
GetProfileIntW
GetCommandLineW
SetThreadPriority
ReleaseMutex
GetProfileSectionA
CreateEventW
LoadLibraryExW

shlwapi

PathUnquoteSpacesA
StrToInt64ExW

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

user32

MessageBoxA

Exports

Exports

?ToTestFunction@@YGKXZ

Sections

.text
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.dbg01
Size: - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ