53be9eea386382ec3eb04cb1cada1d2a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

53be9eea386382ec3eb04cb1cada1d2a_JaffaCakes118
Size

17KB
MD5

53be9eea386382ec3eb04cb1cada1d2a
SHA1

8411c16f79a4a29640c6aa757a44e7164fa453d2
SHA256

dda3fc1ccd8636d258c77e071733da1687fb104c4f35529d98cfcb0615ec7175
SHA512

ba5c05904d26e875b559db14375909219ab653ae30da139ea1bb44f364c98daa92eefe56d246489e44a243df9b846954deb66fae67aff4a174ba6be80fa2dea6
SSDEEP

384:xN4rA/D38Y2Pb3DxDGhddu5gkGm3KlGWP:xN4rA7+5C7IgpzlGWP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
53be9eea386382ec3eb04cb1cada1d2a_JaffaCakes118

Files

53be9eea386382ec3eb04cb1cada1d2a_JaffaCakes118
.dll windows:4 windows x86 arch:x86

9dfbe2747791414523d84573f94a76c8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetSystemDirectoryA
GetCurrentProcessId
FreeLibrary
GetTempPathA
Sleep
GetWindowsDirectoryA
lstrcatA
CreateThread
DisableThreadLibraryCalls
GetCurrentProcess
LoadLibraryA
ExitProcess
CreateMutexA
GetProcAddress

user32

GetWindowTextA
PostMessageA
GetForegroundWindow
wsprintfA
keybd_event
FindWindowExA

advapi32

DeleteService
LookupPrivilegeValueA

msvcrt

fopen
printf
fscanf
fclose
??2@YAPAXI@Z

Exports

Exports

CompareLinkInfoReferents
CompareLinkInfoVolumes
CreateLinkInfo
CreateLinkInfoA
CreateLinkInfoW
DestroyLinkInfo
DisconnectLinkInfo
GetCanonicalPathInfo
GetCanonicalPathInfoA
GetCanonicalPathInfoW
GetLinkInfoData
IsValidLinkInfo
MSCON
ResolveLinkInfo
ResolveLinkInfoA
ResolveLinkInfoW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 794B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ