023c74c4b66ae36cb769b3b86b932f50_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

023c74c4b66ae36cb769b3b86b932f50_JaffaCakes118
Size

62KB
MD5

023c74c4b66ae36cb769b3b86b932f50
SHA1

56df23456224f5e71d402c9791cd5fbb73253572
SHA256

f52deb7cc9c1af00caa89f72acf84b423a1f232419e84ecc3728f0ea2cc3e7c3
SHA512

32c325ec7c5b4308f7f0578658c3237e1d05ab35c9c5387a7fade1673c71fc5383fca9ddd60564f83cf19d0191a96127a45d8483d89335f12de78ede3dc872b7
SSDEEP

1536:ylcot4/d+GgyW1hBKv9D2qNUefnPhzna/Qk99jH:mlVhgv9NUyhe/QQ9jH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
023c74c4b66ae36cb769b3b86b932f50_JaffaCakes118

Files

023c74c4b66ae36cb769b3b86b932f50_JaffaCakes118
.dll windows:4 windows x86 arch:x86

f1a7c45fc327025cccf6d19a02df8176

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

RegisterClassW
OffsetRect
MessageBoxW
MessageBoxIndirectW
MessageBeep
GetMessageW
EmptyClipboard

kernel32

GetCurrentProcessId
TerminateProcess
Sleep
LocalAlloc
LoadLibraryW
FreeLibrary
ExitProcess
DeleteCriticalSection
CloseHandle
CreateFileW

advapi32

RegEnumValueW
RegQueryValueExW
RegSetValueExW
RegCloseKey

comdlg32

GetOpenFileNameW
GetFileTitleW

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dataa
Size: 28KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ