2520f3a800e9acbb2222d8e9b77bcbc3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2520f3a800e9acbb2222d8e9b77bcbc3_JaffaCakes118
Size

1.6MB
MD5

2520f3a800e9acbb2222d8e9b77bcbc3
SHA1

7c64cb3e4e0aface3d296e473be804e23eac1ae1
SHA256

ee094d62a100e134744cb46ee1a4f7c855dea08e6fb6fb7a8c0deb0940dc625e
SHA512

2504456539d1d0b658375e4c0b468a775bbee34a30fea6e572e5446d16df652745cc8dbb04d5ee40b834afbd57015ea224d41f47becf9e0628f29db2c4fa8962
SSDEEP

3072:WkXOL22q7bBMMqbETgtKs3JwVEnOMBDDc:ZXOL2Z7tqYTSKoJwVEOMBD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2520f3a800e9acbb2222d8e9b77bcbc3_JaffaCakes118

Files

2520f3a800e9acbb2222d8e9b77bcbc3_JaffaCakes118
.dll windows:4 windows x86 arch:x86

123ec27e51dd1955840da9a4c8e223aa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryW
SetSystemTime
SetFirmwareEnvironmentVariableW
SetDefaultCommConfigA
GetPriorityClass
PeekConsoleInputA

ntdll

RtlGetNtGlobalFlags
RtlEmptyAtomTable
RtlFreeAnsiString
RtlCheckRegistryKey
RtlRaiseStatus

user32

ValidateRgn
GrayStringA
GetWindowRgn

gdi32

CreateDIBPatternBrushPt
CombineRgn
FillPath
GetDCBrushColor
PaintRgn
Pie
RoundRect
SetDCBrushColor
SetLayout
GdiTransparentBlt
CreateRoundRectRgn

shell32

Shell_NotifyIconW

dnsapi

DnsIsStringCountValidForTextType

Sections

.text
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 978B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 1018B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ