0ce60f3c6dc8179d04d655ec138ac303_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0ce60f3c6dc8179d04d655ec138ac303_JaffaCakes118
Size

50KB
MD5

0ce60f3c6dc8179d04d655ec138ac303
SHA1

d7a89a6034e697145ee494316ca9ae81ea6cf4cc
SHA256

15406edd36b084d712cff46e8b1e3866b5ddaf991ece9ac6e939d9fc3b608bc5
SHA512

f78c7bf00faa645ac67bb3874a8f48d3968c65319d0d88302d0c7065ef8c4826f583ce4d2df8f65618c56275e45bd032e8c0bd887469d2e1295f4c267f654dc1
SSDEEP

1536:AqZ6iyF48gzhTuXc61PjkxWeTXN7A5ZUV:pZ8m8+X1/7NMZm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ce60f3c6dc8179d04d655ec138ac303_JaffaCakes118

Files

0ce60f3c6dc8179d04d655ec138ac303_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1e09b6e52a9e73f1a064a71627dfb007

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\hobot\dll\dll_loader\Release\dll_loader.pdb

Imports

urlmon

URLDownloadToFileA
URLDownloadToCacheFileA

kernel32

HeapAlloc
GetProcessHeap
GetFileSize
GetTickCount
WriteFile
SystemTimeToFileTime
GetSystemTime
GetFileTime
CreateProcessA
CloseHandle
WaitForSingleObject
CreateMutexA
MoveFileA
DeleteFileA
GetSystemDirectoryA
ReadFile
SetFilePointer
CreateFileA
GetModuleFileNameA
GetWindowsDirectoryA

advapi32

RegCreateKeyExA
RegQueryValueExA
RegCloseKey

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 1007B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ