438125072bedff58aee2896b16b9f5c7_JaffaCakes118 | Triage

Sharing

General

Target

438125072bedff58aee2896b16b9f5c7_JaffaCakes118
Size

32KB
MD5

438125072bedff58aee2896b16b9f5c7
SHA1

e0a702f3c4c5d747ad99bc9346ccf851dbd14572
SHA256

6f3bdcaf819242a4a9317c033c2fa98017ca49bd25b0069c597f5f8cb93e0c03
SHA512

d799a60413f092e3359679fdfbe594f9ccd9e269876bff47a5ad6bc84ca764d657a6421261c0f5e417297d8244178527c86459d8854201f2313250a35225168a
SSDEEP

384:jZRmyGaQemmYF5RDYfhdil93dgO54FFS0um0/6uyyHLViTrDuFxyih10fZsZUh:jeaemk5SANgAmvpOVGDu2iv0fWK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
438125072bedff58aee2896b16b9f5c7_JaffaCakes118

Files

438125072bedff58aee2896b16b9f5c7_JaffaCakes118
.dll windows:4 windows x86 arch:x86

127217e0d38814b4ae44f48089bc424e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_adjust_fdiv
_initterm
malloc
_strdup
free

ntdll

NtQueryInformationProcess
NtSetInformationProcess

kernel32

GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeLibrary
FlushInstructionCache
ExitProcess
GetTickCount
QueryPerformanceCounter
RtlUnwind
CreateThread
FindClose
FindFirstFileA
GetVolumeInformationA
GetSystemDirectoryA
GetCommandLineA
VirtualProtect
IsBadReadPtr
GetProcAddress
GetModuleHandleA
VirtualFree
LoadLibraryA
VirtualAlloc
GetVersion
VerifyVersionInfoA
VerSetConditionMask
GetCurrentProcess
ExitThread
CloseHandle
Sleep

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ