f3f031498356f90f6cbe5761b82f1fff_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f3f031498356f90f6cbe5761b82f1fff_JaffaCakes118
Size

24KB
MD5

f3f031498356f90f6cbe5761b82f1fff
SHA1

03def1f614e66a91c58f09a7f15d6591974ef1f3
SHA256

52547bdde374df672c47a2e175d0afb4f2be5d6ca75e6d4a4d9e3b83f71696ac
SHA512

65b738d872ca74bd97a38e23eaf6d42e3ecd1dfcc2d295b9472a75ead0963374189d9dd9f12018d6b1f195c06ee062ac0f4840d1da00d216313b7ef46119be7d
SSDEEP

384:J96rkfA2dE2WRdEAOjmESpct5LooaZvk:J9o2PWRdEAOjmLat5paZvk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f3f031498356f90f6cbe5761b82f1fff_JaffaCakes118

Files

f3f031498356f90f6cbe5761b82f1fff_JaffaCakes118
.dll windows:4 windows x86 arch:x86

77695733ac5c0d9ee5f1bbc392c59c76

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

closesocket
ntohs
ntohl

msvcrt

free
_initterm
strchr
_adjust_fdiv
_itoa
atoi
memcpy
strncpy
strcmp
sprintf
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
_strlwr
malloc

kernel32

Sleep
GetModuleHandleA
ExitProcess
CreateThread
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
lstrlenA
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
GetCommandLineA

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 726B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ