01f8e6a3510f56b76507d0e8f5ca7571_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

01f8e6a3510f56b76507d0e8f5ca7571_JaffaCakes118
Size

5KB
MD5

01f8e6a3510f56b76507d0e8f5ca7571
SHA1

b75c5927d9b5d609b91314fab4e09241ed94c642
SHA256

86808be71fca627d9114764b19aa53116c330f16818c381df77971730a457150
SHA512

7daea4f1bd53f9f416c161716df02b49741903ac3a062d9ffc8ae5a0bdf4e5232a08f1855d22ed684be19d947dbb490f9ad2b923076bf5c004a193ee7d9c57d6
SSDEEP

96:Z14TXnRWV67VfR0czIgBKB7UKE3pD8OL4AwbHicTj0DL7lW:kTBWEVacvGQKE3p4O4AwbHicTj2v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01f8e6a3510f56b76507d0e8f5ca7571_JaffaCakes118

Files

01f8e6a3510f56b76507d0e8f5ca7571_JaffaCakes118
.dll windows:1 windows x86 arch:x86

8748a1c48b1a43af0c2e117390543ad4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wsock32

closesocket
connect
htons
inet_addr

kernel32

CloseHandle
CreateFileA
CreateThread
CreateToolhelp32Snapshot
DeleteFileA
ExitProcess
FreeLibrary
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetTempPathA
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
LoadLibraryA
OpenProcess
Process32First
Process32Next
Sleep
VirtualAllocEx
WinExec
WriteFile
lstrcatA
lstrcmpiA
lstrlenA

Sections

.code
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 782B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 454B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE