00cef2a49ce7370ada427fe92a38ec27_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

00cef2a49ce7370ada427fe92a38ec27_JaffaCakes118
Size

28KB
MD5

00cef2a49ce7370ada427fe92a38ec27
SHA1

e7fe5fbaeba1032b2db91c0583ff668cbe78a431
SHA256

92d1993741a0b74d9c5a288feaace60db43c901ed1afcc89d0eb70ff88411f9f
SHA512

425c4194f4b8d0131b653c4ff217c93eee7e69d2f2f157b61c9ff85c2224f5078adb84b936156d60bd0cade29c9e78fc3d25b7d3141fead277a97ac41b8c1157
SSDEEP

384:dd+OPThCHPlv0rStIK/QSGAHt/24KQyOpct57m:HT80ruFG2Z24uOat57

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00cef2a49ce7370ada427fe92a38ec27_JaffaCakes118

Files

00cef2a49ce7370ada427fe92a38ec27_JaffaCakes118
.dll windows:4 windows x86 arch:x86

9fcb03b0e02accc739b2fa05ff6d0d3a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

closesocket
ntohs
ntohl

msvcrt

strchr
free
memcmp
malloc
_adjust_fdiv
_itoa
atoi
memcpy
strncpy
strcmp
sprintf
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
_strlwr
_initterm

kernel32

Sleep
GetCommandLineA
ExitProcess
GetModuleHandleA
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
lstrlenA
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
CreateThread

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1014B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 748B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ