054ecb08c13791362cb15c8b60dfa9e0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

054ecb08c13791362cb15c8b60dfa9e0_JaffaCakes118
Size

197KB
MD5

054ecb08c13791362cb15c8b60dfa9e0
SHA1

42d3f3923b32085e0a0b31c41ad58b458832c6bd
SHA256

abf3039684041f75bbefddb0d14d939a974ce353d0fca1c577ace8e2b5d70293
SHA512

1a2236cc0221053ace5597fe0b2d87495977bac511061ad357fb9b12207c424b044667c73cc89c76cddf7fca66bd09af23e67c35140482f411495a358600a75e
SSDEEP

3072:6L1Z8p7fIUXST0JElMUPwNsEB40jhTVdkWGqzjTT6Pi:6LCzIasEB40j1H1GqzT/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
054ecb08c13791362cb15c8b60dfa9e0_JaffaCakes118

Files

054ecb08c13791362cb15c8b60dfa9e0_JaffaCakes118
.dll windows:5 windows x86 arch:x86

45f6c90dd10ccf1cd5f8bc93d1bca2b6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
GetProcAddress
GetVersionExA
LoadLibraryA
GetFileAttributesA
UnhandledExceptionFilter
lstrlenW
VirtualAllocEx
GetStartupInfoA
FreeLibrary
ReleaseMutex
CloseHandle

user32

LoadCursorA
LoadIconA
SetForegroundWindow
SendMessageTimeoutA
LoadStringA
GetWindowThreadProcessId
MessageBoxA

comdlg32

GetOpenFileNameA
GetSaveFileNameA

shlwapi

SHGetValueA
PathRemoveFileSpecA
StrCmpIW
StrStrIA
SHSetValueA

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 788B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ