2d0e67ed044b58dfd12378a92b6ed9b0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2d0e67ed044b58dfd12378a92b6ed9b0_JaffaCakes118
Size

204KB
MD5

2d0e67ed044b58dfd12378a92b6ed9b0
SHA1

73fa12d5555dd8c87c7f95d1d82ce78170567cba
SHA256

abee5a2d6ee30fffd6ea43766632058df7ef9d326f3548f3c0e4e83d1dfd1389
SHA512

f9826235926896d56cf8618ce1e8cb11e7c4ae3ea12abbf32e55993b14d4e201625ea5ceee9bb9ff6dd7c4e3a70f1b4b878575cf7be22788525c7e968c51a6df
SSDEEP

6144:aMMlX6jjjjjjjjjjjjjjjjjjjjjjjj/DKpGlnwt1myQtAUUawjSH76:LgXKWYwtEttJwjSO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2d0e67ed044b58dfd12378a92b6ed9b0_JaffaCakes118

Files

2d0e67ed044b58dfd12378a92b6ed9b0_JaffaCakes118
.dll windows:4 windows x86 arch:x86

858c82558766277ff0d245f3789f1d39

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\First\To\Must\Case.pdb

Imports

kernel32

IsBadReadPtr
OutputDebugStringA
GetModuleFileNameW
FreeResource
GetModuleHandleW
GetVersion
LockResource
DuplicateHandle
SetEvent
IsBadWritePtr
HeapSize
GetOEMCP
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetTimeZoneInformation
GetLocalTime
GetConsoleCP
IsBadStringPtrW

Exports

Exports

InBothPreservedMustLearn
ThatAreName
TheBeForIsA

Sections

.text
Size: 140KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 202KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ