36ec677463a75774c9bd5c11d244ada0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

36ec677463a75774c9bd5c11d244ada0_JaffaCakes118
Size

42KB
MD5

36ec677463a75774c9bd5c11d244ada0
SHA1

9b73a1417dfe2ceabf0c813fbb00b3ac316f6049
SHA256

ae35e5d5fb1b85028cd9c5756c9314b898115b60090512f13a8c0010276acc3b
SHA512

c40939becb7df73e840da157d1429c6d560085173c873cb37cc0f93aeeeacbdd4de0f28be303e3d1e02f35f3bbc7d05ce9cd87b6814b98b8251256058e65722d
SSDEEP

384:9Fazs56f0QP8Ao3/pg5LpAKKDHwMw60dpkd8R8fM+0Wg0E9zJqieB5RjkRLqAeav:986KKDU6QPt0E9zJqieONeaJFsZq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
36ec677463a75774c9bd5c11d244ada0_JaffaCakes118

Files

36ec677463a75774c9bd5c11d244ada0_JaffaCakes118
.dll windows:4 windows x86 arch:x86

3f43413e4cc805bfb19e82f49b9046ef

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

AddAtomA
CreateThread
DisableThreadLibraryCalls
ExitProcess
FindAtomA
GetAtomNameA
GetModuleFileNameA
GetModuleHandleA
IsBadReadPtr
IsBadWritePtr
Sleep
VirtualProtect

msvcrt

__dllonexit
_errno
_iob
abort
fflush
fprintf
free
malloc
memcpy
strstr

user32

GetAsyncKeyState
MessageBeep
MessageBoxA

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 176B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 836B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ