fbd29e9d80560df3b4c92980379c1cdb_JaffaCakes118 | Triage

Sharing

General

Target

fbd29e9d80560df3b4c92980379c1cdb_JaffaCakes118
Size

307KB
MD5

fbd29e9d80560df3b4c92980379c1cdb
SHA1

41d762f7215fad1bc9bdc8ddf327d0b011b52a16
SHA256

c460ddd3bb08497b384975612f89f5e52d824c4314b8c8c55cd30a02e791c4af
SHA512

168f2f4fb0fea4100d996c5fc764c829dd4c5da833f50feec3c2f4ba2d19891ba7aa3aa93ab927957fe9493a4728abb9a502f05e0d4013f9fdcfca2334099541
SSDEEP

6144:eLt1v2Jso+1Y9oD1NhSvk1zo04MhWJeTrcqSMZ8CkVOSeNg2:eLtk2+SD1G0zo0NhgeTr2MZ8CH9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fbd29e9d80560df3b4c92980379c1cdb_JaffaCakes118

Files

fbd29e9d80560df3b4c92980379c1cdb_JaffaCakes118
.dll windows:4 windows x86 arch:x86

1a4f68363ac38fcf8ae88d8cb6e8c0d3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualFree
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc

user32

CheckMenuItem
GetCursorPos
BeginDeferWindowPos

gdi32

LineTo
CreateCompatibleDC

Sections

.text
Size: 233KB - Virtual size: 428KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.aspack
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ