JaffaCakes118_4426ec8e6bcb568fc8ab4d84ab2ec3f8 | Triage

Sharing

General

Target

JaffaCakes118_4426ec8e6bcb568fc8ab4d84ab2ec3f8
Size

69KB
MD5

4426ec8e6bcb568fc8ab4d84ab2ec3f8
SHA1

0dc39524f41f928e06e5a3931ad8d45231e9cb8f
SHA256

482e0d297f6900be8e0146384d61537ad6bc63e2ab94bd8a199ed769159e0abc
SHA512

1cc52ef5388e5a2686a0f6ad221ee2812c248842e6f8cae84c0ea1295416232adf9c0778cd862f4756cd39465209b23ea511336dedff6bd8fc7cc0201a706120
SSDEEP

1536:tm+yeA6LmpLHe2Aj6xCt/GxMH/J7hTHfHBZxvmIYMIbCntT/:t6emeFj3pRVr/xvVY7beZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_4426ec8e6bcb568fc8ab4d84ab2ec3f8

Files

JaffaCakes118_4426ec8e6bcb568fc8ab4d84ab2ec3f8
.dll windows:1 windows x86 arch:x86

60dc799067c40dea47b01bcd212a0405

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
FindNextFileA
FindResourceA
FormatMessageA
GetCommandLineA
GetCurrentProcessId
GetEnvironmentVariableA
GetFullPathNameA
GetModuleHandleA
GetSystemTime
GlobalAlloc
GlobalFree
LoadResource
LocalAlloc
LockResource
ReadFile
SetEvent
SizeofResource
UnlockFile
VirtualAlloc
VirtualFree
VirtualQuery
lstrcmpiA
lstrlenA

user32

MessageBoxA

Exports

Exports

CreateProcessNotify

Sections

.text
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 81B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 18B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 704B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ