2b06e41ef0460182129a1bd757374582_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2b06e41ef0460182129a1bd757374582_JaffaCakes118
Size

277KB
MD5

2b06e41ef0460182129a1bd757374582
SHA1

e603bc124135a885af1cb25fdcdd9794d7a4bab9
SHA256

c0c3e03652eeafd794c847b6cfc81a5ad358e987195a46acb577568de3d20ea4
SHA512

687aac189a6a6f2416c5c1f6685aa7585e5aff08b50fd5f9c3523cea8bee068eb1d7aa01286ffbbd341d72c0093fcdf9a8060512ada04d1a8a1f4938940ccaae
SSDEEP

3072:VD2cD2cD2cD2cD2cD2cD2cD2cD2cD2cD2cD2cD2cD2cD2:VKcKcKcKcKcKcKcKcKcKcKcKcKcKcK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2b06e41ef0460182129a1bd757374582_JaffaCakes118

Files

2b06e41ef0460182129a1bd757374582_JaffaCakes118
.dll windows:4 windows x86 arch:x86

103740a5cb7c513d03c8cbc463e486c2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetMessageA
wsprintfA

kernel32

CloseHandle
CreateFileA
CreateThread
DisableThreadLibraryCalls
GetCurrentProcess
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetWindowsDirectoryA
GlobalAlloc
LoadLibraryA
ReadFile
RtlMoveMemory
RtlZeroMemory
SetFileAttributesA
SetFilePointer
Sleep
TerminateProcess
VirtualProtectEx
WideCharToMultiByte
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrlenA

advapi32

RegQueryValueExA

Exports

Exports

EnHookWindow
UninstallHook
sub_getmessage
sub_keyboard
sub_mouse

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 12B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 1015B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ