0d28f5eb9c3209cb0a895f8a48d3a9fb_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0d28f5eb9c3209cb0a895f8a48d3a9fb_JaffaCakes118
Size

9KB
MD5

0d28f5eb9c3209cb0a895f8a48d3a9fb
SHA1

a92044289e848551856d8178e9afae405b50108d
SHA256

9be8be2201e3c6a3242d84f3992b7ff8e1438849f7285b7d56d497f748a38785
SHA512

c47c6359790e1dc5dce56398fc3946bdf8b28a1fdb141cb0e922caa9c9b8e83d74597c53453adaa25625f34439640df9b8bc72e5eed9bc5a901a34787cf0c115
SSDEEP

192:B8ruHEdWoJG1d95PxL6dmsTnDEhEofgoUPJcByi:B8KHEdlG1xxL6dmCgVUxqy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0d28f5eb9c3209cb0a895f8a48d3a9fb_JaffaCakes118

Files

0d28f5eb9c3209cb0a895f8a48d3a9fb_JaffaCakes118
.dll windows:4 windows x86 arch:x86

38ea03c5f8620e59e0b4b065a9f0b033

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wsock32

WSAStartup
socket
closesocket
gethostbyname
htons
connect
send
recv
WSACleanup

kernel32

CloseHandle
CreateToolhelp32Snapshot
Process32First
OpenProcess
TerminateProcess
Process32Next
lstrcmpiA
GetModuleHandleA
GetProcAddress
Sleep
lstrlenA
lstrcatA
lstrcpyA
WriteFile
CreateFileA

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 250B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ