2bf09374e97240bbf660392dcd394853_JaffaCakes118 | Triage

Sharing

General

Target

2bf09374e97240bbf660392dcd394853_JaffaCakes118
Size

17KB
MD5

2bf09374e97240bbf660392dcd394853
SHA1

848822be933ede9e0d940714b97122a1126972a6
SHA256

d3cfed620012080c2ee51c4838d867082e43e826f1e2869638ed28071c69235b
SHA512

3e536f87b09b461ec3dcd651ef76c79e520fe3dde4b4ccd2de6f6d6d25cb741631777c76d3d76945f2e60285843df23cfc0850dd33fac7ec6f0b46995971e0ab
SSDEEP

384:ESiL4opEvZwv0oWGvnmDMLGhddHjmP7W9fWr3u:Ex4opEOmlDMK71xiu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2bf09374e97240bbf660392dcd394853_JaffaCakes118

Files

2bf09374e97240bbf660392dcd394853_JaffaCakes118
.dll windows:4 windows x86 arch:x86

6c88de642fffcdef7bf27436b4a11bdd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
lstrcatA
GetSystemDirectoryA
FreeLibrary
GetWindowsDirectoryA
CreateMutexA
CreateThread
ExitProcess
GetCurrentProcess
Sleep
DisableThreadLibraryCalls
GetProcAddress

user32

GetForegroundWindow
FindWindowExA
PostMessageA
wsprintfA
keybd_event
GetWindowTextA

msvcrt

fopen
printf
fscanf
fclose
??2@YAPAXI@Z

Exports

Exports

CompareLinkInfoReferents
CompareLinkInfoVolumes
CreateLinkInfo
CreateLinkInfoA
CreateLinkInfoW
DestroyLinkInfo
DisconnectLinkInfo
GetCanonicalPathInfo
GetCanonicalPathInfoA
GetCanonicalPathInfoW
GetLinkInfoData
IsValidLinkInfo
MSCON
ResolveLinkInfo
ResolveLinkInfoA
ResolveLinkInfoW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ