3b48eda866e27228ecc73c01a20e3e21_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3b48eda866e27228ecc73c01a20e3e21_JaffaCakes118
Size

164KB
MD5

3b48eda866e27228ecc73c01a20e3e21
SHA1

b6f2a88be02505e061c105361ae155928357657b
SHA256

db4e60797f9fa6074385d91563eede51f12f3e6b872e15d30a99c6a2ab9acc4e
SHA512

fd171041388ed3ba63f29c249f0c65e58f40582d8c42347f4cf67181ab55911d083baf715ca17209826b6942e8ba079dd91d151289570549696be24fa4ce59f9
SSDEEP

3072:dpY5D7nmUgy18FDHOiW3R5Gp+wDtlEJD4BTdFItsDPkOiBpLv1sef9U:dpI7mUgy1YDHOdwpnp+N4BTdFItCPkOo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b48eda866e27228ecc73c01a20e3e21_JaffaCakes118

Files

3b48eda866e27228ecc73c01a20e3e21_JaffaCakes118
.dll windows:4 windows x86 arch:x86

5eb2c17d00a5bea71302182f36d5d3c1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WaitForSingleObject
LoadLibraryA
GetProcAddress
Sleep
ExitProcess
CreateProcessA
GetCommandLineA
GlobalFree

ole32

CoCreateGuid

user32

RegisterWindowMessageA
ScreenToClient
TranslateMessage

advapi32

RegCloseKey
OpenProcessToken
RegOpenKeyExA

Exports

Exports

AgereMainCmds

Sections

.text
Size: 136KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 639B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ