17e42f75b2235dac0fd16c76960d6a3f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

17e42f75b2235dac0fd16c76960d6a3f_JaffaCakes118
Size

12KB
MD5

17e42f75b2235dac0fd16c76960d6a3f
SHA1

48a5a40021a76da1779f73d823c0678cc9ffbcd5
SHA256

a6bb9e748e68f3f5e744d1b8a57a04d164fc892a1eb2945f0aa3e9242ba46bf0
SHA512

967e7990287c6ed67af924ae7ee45302878ff9ffa2e38489259b29c7b0410a082cbbee789a28dfe789ac7208bafb55beb03769a4e874d1895b5528e4848b5d53
SSDEEP

384:ecc0d7TMaBPtpmUR7Z11bBoP5PtJiH+Ph:ecc0pV71bBoP52H+Ph

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17e42f75b2235dac0fd16c76960d6a3f_JaffaCakes118

Files

17e42f75b2235dac0fd16c76960d6a3f_JaffaCakes118
.dll windows:5 windows x86 arch:x86

8bad5c2447491e26190e836fbdf08091

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ExitProcess
CreateFileA
GetFileSize
SetFilePointer
HeapAlloc
HeapFree
WaitForSingleObject
GetTickCount
GetProcessHeap
GetSystemTimeAsFileTime
WriteFile
Sleep
CreateProcessA
ReadFile
FindFirstFileA
GetLastError
FindClose
MoveFileA
GetModuleFileNameA
GetModuleHandleA
VirtualProtect
CloseHandle
GetVersion
DeleteFileA
CreateThread

user32

GetWindowThreadProcessId
EnumChildWindows
GetDlgItem
GetWindowLongA
EnumWindows
CloseDesktop
GetClientRect
FindWindowExA
CreateDesktopA
GetClassNameA

Exports

Exports

_Main@0

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 994B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ