371dc93f2ec7454e56f9512d71c82117_JaffaCakes118 | Triage

Sharing

General

Target

371dc93f2ec7454e56f9512d71c82117_JaffaCakes118
Size

43KB
MD5

371dc93f2ec7454e56f9512d71c82117
SHA1

6a05708375cfd3b625764845c1cb8fb531f11555
SHA256

f48c6818e42a9e0360e97775544587a81266cd902254b29157e1ac21ea6438e3
SHA512

ac9947a0782fda2dae52ecf0a11db1e99d9852d4bcbf3e51c9fea5c630abd202a7cf684d20ef33cfed123875ca51657d0453ddb738d6804d3cb97f826f11cd53
SSDEEP

768:jxcuKrE+gXeM0r8X0pMcekz2A8wn/S3iqgrZ2jbAfouJNIrrEF0U9aNG8:jxcho5aY0pMceX5w/5nZbHBF79m

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
371dc93f2ec7454e56f9512d71c82117_JaffaCakes118

Files

371dc93f2ec7454e56f9512d71c82117_JaffaCakes118
.dll windows:5 windows x86 arch:x86

2a7e2418be8a09fc671a0ee84b34f19e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualAlloc
VirtualFree
ExitProcess
lstrcmpiA
VirtualProtect
IsBadReadPtr
GetProcAddress
LoadLibraryA
CreateThread
GetModuleHandleA

user32

MessageBoxA
DefWindowProcA
CreateWindowExA
RegisterClassExA
LoadCursorA
LoadIconA
SendMessageA
KillTimer
GetMessageA
DispatchMessageA
TranslateMessage
SetTimer

Exports

Exports

func1
func2
start

Sections

.text
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 838B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 620B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ