151eb18f5697918106bd72e4b2d9e76f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

151eb18f5697918106bd72e4b2d9e76f_JaffaCakes118
Size

17KB
MD5

151eb18f5697918106bd72e4b2d9e76f
SHA1

56aaa2368c38a921f05f1bf268b872c0ea3789f9
SHA256

f7a77e4236d75f13ecaebe5f5b6e09f4d4dc2cd3d7c1c3cfc606ee30ee1174f9
SHA512

5027d606f27b0855a32229c00d60b57af29072f9a880de461a871c074df63140339dc8876c9910d922650e48df0b2f3da63e2ef7ab45a56b463da34e1abba87a
SSDEEP

384:ES44YvTg8rCqPna7DluGhddQ33jmPHkW9fWu3:Ep4O2J7DlV7+3zY33

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
151eb18f5697918106bd72e4b2d9e76f_JaffaCakes118

Files

151eb18f5697918106bd72e4b2d9e76f_JaffaCakes118
.dll windows:4 windows x86 arch:x86

6c88de642fffcdef7bf27436b4a11bdd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
lstrcatA
GetSystemDirectoryA
FreeLibrary
GetWindowsDirectoryA
CreateMutexA
CreateThread
ExitProcess
GetCurrentProcess
Sleep
DisableThreadLibraryCalls
GetProcAddress

user32

GetForegroundWindow
FindWindowExA
PostMessageA
wsprintfA
keybd_event
GetWindowTextA

msvcrt

fopen
printf
fscanf
fclose
??2@YAPAXI@Z

Exports

Exports

CompareLinkInfoReferents
CompareLinkInfoVolumes
CreateLinkInfo
CreateLinkInfoA
CreateLinkInfoW
DestroyLinkInfo
DisconnectLinkInfo
GetCanonicalPathInfo
GetCanonicalPathInfoA
GetCanonicalPathInfoW
GetLinkInfoData
IsValidLinkInfo
MSCON
ResolveLinkInfo
ResolveLinkInfoA
ResolveLinkInfoW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ