01bd92b844fcf27d5d8118187c053c02_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

01bd92b844fcf27d5d8118187c053c02_JaffaCakes118
Size

173KB
MD5

01bd92b844fcf27d5d8118187c053c02
SHA1

2654f34b00b6f5e6e7fb34ebd246ec8652d90918
SHA256

dae4b7263404247c732c88bd2833b98b6df514c2e19bdb367c62be0275adf624
SHA512

55b7b4490d5819b02fb3fc1c8319a2862954c9b34c664ea4061c3500f1333374115f0c3a70b05fe04bfc370c00af9a480ec41dfd5978638c41dd08b7d0290182
SSDEEP

3072:Bys4NjJxHiOtcq/WTqrEFzD7k6OtMmIQivC62bUFNO2dyBFhnjTbbSDZ:ojNbCccqYPFXmWmcN2bcyhbSD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01bd92b844fcf27d5d8118187c053c02_JaffaCakes118

Files

01bd92b844fcf27d5d8118187c053c02_JaffaCakes118
.dll windows:5 windows x86 arch:x86

48173c0c152c121dccf887d39ef202f3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\MASM64\64Source64\C\32\VAX\Version_vax_src160108_KO2_5\Release\lpk.pdb

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

DefWindowProcW

gdi32

SetTextColor

advapi32

RegCloseKey

shell32

CommandLineToArgvW

shlwapi

PathFileExistsA

Exports

Exports

LpkDllInitialize
LpkDrawTextEx
LpkEditControl
LpkExtTextOut
LpkGetCharacterPlacement
LpkGetTextExtentExPoint
LpkInitialize
LpkPSMTextOut
LpkTabbedTextOut
LpkUseGDIWidthCache
ftsWordBreak

Sections

.text
Size: 166KB - Virtual size: 312KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE