e88e111e899ad6ebf9611d4a21f1ac66_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e88e111e899ad6ebf9611d4a21f1ac66_JaffaCakes118
Size

28KB
MD5

e88e111e899ad6ebf9611d4a21f1ac66
SHA1

838a05fa420960c79bcccb27e4582243d6ae48b0
SHA256

2212f8446d9195856626cad0f8014ef1c5384c82db1425ebb24f233dfcb85291
SHA512

479242137f5a0ba935f60ca05d619c9d3286cffaac554545a52639ea16e51f712ed13f61902b9aef94a309e19721514d59ae2eb9af2e561231bdc06021001d60
SSDEEP

384:GyWsZclcd3eAdI6gqtTPTnw0MTctciDdOX:GAcixb26gqtTPTnw0MTctcie

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e88e111e899ad6ebf9611d4a21f1ac66_JaffaCakes118

Files

e88e111e899ad6ebf9611d4a21f1ac66_JaffaCakes118
.dll windows:4 windows x86 arch:x86

078692981e6155ee2c3152d95234182e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

malloc
_adjust_fdiv
_initterm
free
memcmp
atoi
memcpy
strncpy
strchr
strcmp
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
_itoa
_strlwr

kernel32

Sleep
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
CreateThread
lstrcmpA
lstrlenA
lstrcpyA
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
ExitProcess

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1010B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ