0a6cf33822a47589ea8c542d2bdb0dbb_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0a6cf33822a47589ea8c542d2bdb0dbb_JaffaCakes118
Size

88KB
MD5

0a6cf33822a47589ea8c542d2bdb0dbb
SHA1

5871df3c5d9dcc6236c733efb5af2575e6154a4c
SHA256

da63fe4230d0be1cdabbd4b7dc40067bac274b455a076b35e8476c89ee84bdf0
SHA512

4c02b89f0c19891e2dded989ec98456ed9b3f8d74ab2e352445da17148caaed1fa0e0e2855c5674f73e9fce6623478270adb2195c29d98ccd7a75db14feb9fbb
SSDEEP

1536:WQr9ab96a6XuJYgC8U7Bs/Bt/guVitIRJvqxRWsdYC7rU8nnH/JVvIWBh:WU1F9Bmr/fuIRJ1sd/77B

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a6cf33822a47589ea8c542d2bdb0dbb_JaffaCakes118

Files

0a6cf33822a47589ea8c542d2bdb0dbb_JaffaCakes118
.dll windows:6 windows x86 arch:x86

00daca36db3bfeb80052f7ace0ac2520

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Nlsdl.pdb

Imports

msvcrt

_adjust_fdiv
_amsg_exit
_initterm
free
malloc
_XcptFilter

ntdll

RtlUnwind

kernel32

TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
InterlockedExchange
GetLocaleInfoW
GetProcAddress
SetLastError
GetVersionExW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess

Exports

Exports

DownlevelGetParentLocaleLCID
DownlevelGetParentLocaleName
DownlevelLCIDToLocaleName
DownlevelLocaleNameToLCID

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ