09ba6821cf7db03e1f55196c7921afbc_JaffaCakes118 | Triage

Sharing

General

Target

09ba6821cf7db03e1f55196c7921afbc_JaffaCakes118
Size

71KB
MD5

09ba6821cf7db03e1f55196c7921afbc
SHA1

22db1390ad9f0594833bbaac71e795c2d01d4ee3
SHA256

106e441409c810e60db8857513ce273c927dc54c01487a61a5ffbbb83810390f
SHA512

85253ac5d1c69f70ec7058ae072c55ceda7a5c6dc365b513813870a40c4ad1151050f983d53395095c6d2f0c9a634be7d33a0d42f9ce435e2b3fb3afa9a8d42e
SSDEEP

1536:FAUAwBbj/qvHSnUDkb7kX446/c5Y5Fj+HodghllxVCjtUq:FRAouvyxkXG/N5FCHo4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09ba6821cf7db03e1f55196c7921afbc_JaffaCakes118

Files

09ba6821cf7db03e1f55196c7921afbc_JaffaCakes118
.dll windows:5 windows x86 arch:x86

cbf4e9f7930ec855ff1a7abecf33dec1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Information\Desktop\Windows\OS_Starter.exe

Imports

msvcrt

_cexit
_exit
__p__fmode
__setusermatherr
_XcptFilter
__p__commode
strspn
__set_app_type
_controlfp
vswprintf
perror
_initterm
mbtowc
_ismbblead
exit
_amsg_exit
__getmainargs

kernel32

QueryPerformanceCounter
LocalLock
FindResourceA
VirtualFree
GetShortPathNameA
VerSetConditionMask
GlobalHandle
SearchPathW
DeleteFileA

user32

ClipCursor
DrawStateW
CharNextExA
GetWindowTextLengthW
VkKeyScanW
GetWindowLongW
DrawIcon
PostMessageA
GetClassInfoW
SetRectEmpty

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ