4073a473d46a7ff8b23d3dab10ddd531_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4073a473d46a7ff8b23d3dab10ddd531_JaffaCakes118
Size

104KB
MD5

4073a473d46a7ff8b23d3dab10ddd531
SHA1

3634d25bef3e14479a5f5db307b853fdd16870fc
SHA256

123650c38fd88ea59c8daebf77ae0a6d379eedbb058302ea655b59a5dc74250e
SHA512

32a347367617b68745a6d11736b32fec52e389d395aa5ab61b1256c90e1189b8b0cf73a1fa9ac32d26e1e510938f1b9b7c7a47e50a1461ee9d07cd0f227983d8
SSDEEP

96:J5to9l5JBNONMhEGqCsC2qivsCU1u93P1:J5t6qKhE/IK7j

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4073a473d46a7ff8b23d3dab10ddd531_JaffaCakes118

Files

4073a473d46a7ff8b23d3dab10ddd531_JaffaCakes118
.dll windows:4 windows x86 arch:x86

685588289ab91f5778b8217f25b81786

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\s4\d1\Release\d1.pdb

Imports

msvcrt

_adjust_fdiv
malloc
sprintf
_initterm
free
_strupr
strstr

kernel32

CloseHandle
CreateFileA
SetFilePointer
GetSystemDirectoryA
WriteFile

user32

wsprintfA
CallNextHookEx
ToAscii
GetClassNameA
FindWindowExA
SendMessageA
GetKeyboardState
GetForegroundWindow
GetWindowTextA
GetWindow
SetWindowsHookExA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

Exports

Exports

?fnDLL@@YAHPAPAD@Z

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

x12Share
Size: 84KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ