fbad4dcaa37c81afc7960819aa583429_JaffaCakes118 | Triage

Sharing

General

Target

fbad4dcaa37c81afc7960819aa583429_JaffaCakes118
Size

169KB
MD5

fbad4dcaa37c81afc7960819aa583429
SHA1

8e7513295841747d49f9a23974a240aa7fe7f623
SHA256

92be7be3a25a0aca857f2d16b9afe038e415af07f70e3f1382afb57b45270a30
SHA512

b0c4853c322fb9844dd3ef862a3eece4ea404f39cfdeb0a43b45d8c4f3ee92cbad99a9a248451fe159ccff4de933eb29bd503e71c86d9a06b16b20a73ac91c98
SSDEEP

3072:KpoEzBPEb+k3OycKHCx8qAIi7p61jY2aV1DFGAJ7W8VeUh:HEzBsb+sBCvAIC81Hy8Ag

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fbad4dcaa37c81afc7960819aa583429_JaffaCakes118

Files

fbad4dcaa37c81afc7960819aa583429_JaffaCakes118
.dll windows:4 windows x86 arch:x86

5acafc82443bd14950cbf31e3d66a4ed

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualAllocEx
LoadLibraryA
GetProcessHeap
LoadLibraryExA
RaiseException
VirtualAlloc
ExitProcess

gdi32

GetBkColor
SaveDC
CreatePenIndirect
GetBkMode

user32

TranslateMessage
UnhookWindowsHookEx
IsMenu
UnregisterClassA
GetMenu
CharLowerA
WaitMessage

comdlg32

FindTextA
GetSaveFileNameA
ChooseColorA

Exports

Exports

_jhY6e2
WoyxpMfWUsqjL
_Amy5Cmu7CZfR1K@4
_NwuBK9wgmte@8
9wrFWUKDg
_qO_Y4dfzz6Ccj2
_WIj8jLm_wlxovJ@20
_2IemZGq8wuQ@20
_CzAvM8IdKUHkxA@12
A_kLE1tCY4yN6
_htVnEXZpyZwsp
Jdq7pX3bUJ
hzy1jEP@24
6AuFipDYIKA@12
_Bwn2BjGDGR
_KE3GQXlLGa
GiWy0hxbO
_N4qDKOg

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 153KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ