42e52f6c9d64ed71198c1ba696aebc9e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

42e52f6c9d64ed71198c1ba696aebc9e_JaffaCakes118
Size

51KB
MD5

42e52f6c9d64ed71198c1ba696aebc9e
SHA1

b08a66e23fa64453019680762c5e7c6a5cb9e20c
SHA256

fc55c7b1b0e06e5623c441ea304fdc492eba1e97e41b4c3e1bdebc3faac45dd6
SHA512

ddb287d0d1e9511bc8d89ec14e2d54dd45f0a8ab9e82aeef0a31aeee97a296d2d10fcd79e0bf0068eaedaa37c31226c8a67f82ca7f746d60ac1409f76043880d
SSDEEP

1536:JsAAAV/SNW0nuwNH1XJlIfgUEcKGUKjT7Boc:V/ONHZsfgZYT76c

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
42e52f6c9d64ed71198c1ba696aebc9e_JaffaCakes118

Files

42e52f6c9d64ed71198c1ba696aebc9e_JaffaCakes118
.dll windows:4 windows x86 arch:x86

8a0b1d7618f0d54659a6940156ea5da0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCommandLineA
GlobalAlloc
VirtualProtect
GlobalFree
EnterCriticalSection
InitializeCriticalSection
InterlockedIncrement
WaitForSingleObject
InterlockedCompareExchange
InterlockedDecrement
HeapAlloc
GetProcessHeap
HeapFree
CreateEventA
CreateSemaphoreA
CloseHandle
LeaveCriticalSection
TlsFree
InterlockedExchangeAdd
DeleteCriticalSection
TlsSetValue
TlsGetValue
InterlockedExchange
ReleaseSemaphore

msvcr71

_except_handler3
_adjust_fdiv
free
malloc
_initterm
__CppXcptFilter
__dllonexit
_onexit

Sections

.text
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 1004B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 682B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ