072a14e14c7b7d405ac76f5f3873b31c_JaffaCakes118 | Triage

Sharing

General

Target

072a14e14c7b7d405ac76f5f3873b31c_JaffaCakes118
Size

21KB
MD5

072a14e14c7b7d405ac76f5f3873b31c
SHA1

062338e16cc09c3fdbc8f3da256233f55f09d31b
SHA256

39c3d0109581d97cc8296691434aa2a129227203e88bb46d94b5dc14bbbaed47
SHA512

39d07fa068e7240337312e553ac3c0cb590196844a0cf8d903f28e763aa517d8fea8d356f5bad457d215433c0a7f92f76a7dde073249d8f24abc8bb6ceebe85f
SSDEEP

384:jqVmnG7eBAqSGGtghp/z8WebiX3r1FUtjjjjjjjjjjjjjXjjYj6qj6j+jjjjjUVm:jBnGKBAqDIiX3Pd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
072a14e14c7b7d405ac76f5f3873b31c_JaffaCakes118

Files

072a14e14c7b7d405ac76f5f3873b31c_JaffaCakes118
.dll windows:4 windows x86 arch:x86

c6f95d9d535837ba4a5307a3c50f7448

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSACleanup
WSAStartup
recv
closesocket
send
gethostbyname
htons
socket
connect

kernel32

CloseHandle
OpenEventA
SetEvent
VirtualQuery
CreateThread
GetTickCount
lstrcatA
lstrlenA
GetWindowsDirectoryA
GetSystemDirectoryA
lstrcmpiA
lstrcpyA
lstrcpynA
GetSystemTime
GlobalFree
GlobalAlloc
lstrcmpA
DeleteFileA
GetTempFileNameA
GetTempPathA
WinExec
GetModuleFileNameA
RtlUnwind
WriteFile
CreateFileA
CreateProcessA
GetLastError
FindFirstFileA
FileTimeToSystemTime
FindClose
GetComputerNameA
Sleep
CreateMutexA
ExitProcess

user32

SetWindowsHookExA
CallNextHookEx
SendMessageA
CharLowerA
wsprintfA

advapi32

RegCreateKeyA
RegQueryValueExA
RegCloseKey

Exports

Exports

Activate

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 522B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ