fe7630320000e354032c18fdae16af21_JaffaCakes118 | Triage

Sharing

General

Target

fe7630320000e354032c18fdae16af21_JaffaCakes118
Size

52KB
MD5

fe7630320000e354032c18fdae16af21
SHA1

c30062910c38ac924dd093cc57814d1ed987da48
SHA256

298373492d1c069be7dc17748bd85b61d7292dc01d7744b8eb10fae087a5c66d
SHA512

4a781a9d8beb63649236f5ed546e7bc6898d3d25428dc55d885d56426651246dfd2af9b1c26b8677b335cbd474bd7ff27db913a7ffb0c3b876556236e2961fb1
SSDEEP

1536:a3idBevKuP4LCb/YiLZY9My7ye6Us9F9En:aydBeCubb/YiWZ7yeTs7+n

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fe7630320000e354032c18fdae16af21_JaffaCakes118

Files

fe7630320000e354032c18fdae16af21_JaffaCakes118
.dll windows:4 windows x86 arch:x86

471c72f112e180f798a6fe17ec9ef21f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

BlockInput

gdi32

GetDIBits

advapi32

LsaFreeMemory

shell32

SHGetSpecialFolderPathA

msvcrt

_strnicmp

winmm

waveOutUnprepareHeader

ws2_32

WSAStartup

msvcp60

?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ

imm32

ImmReleaseContext

wininet

InternetReadFile

msvfw32

ICSeqCompressFrame

wtsapi32

WTSFreeMemory

userenv

CreateEnvironmentBlock

psapi

EnumProcessModules

Exports

Exports

Install
MyNewFun
wintest

Sections

.text
Size: 45KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE