1b7a07c6021ad38c0c466ec3d6cb4f14_JaffaCakes118 | Triage

Sharing

General

Target

1b7a07c6021ad38c0c466ec3d6cb4f14_JaffaCakes118
Size

24KB
MD5

1b7a07c6021ad38c0c466ec3d6cb4f14
SHA1

a89833db78089a8a0cb02e59459bcadf823a66b1
SHA256

dc4910461ec12deae1ff956d70258d015c069ae7f969c33e14d9fa39e3fb198d
SHA512

8eebc7703be7db3a62dc9c7bae0206e828bc49914ad28b922af520fd8bcd0f56ec1d8d107c0adf269911ee0d5aef898002cc4584e79e4717ab7088cfbbe9459e
SSDEEP

192:UxXwTiyREK37hQKfabE2v5GgLLmeYl9KensG6qpFDH0jzDILjq:EyRE8+K+EqlLg/sN0jAzkvq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1b7a07c6021ad38c0c466ec3d6cb4f14_JaffaCakes118

Files

1b7a07c6021ad38c0c466ec3d6cb4f14_JaffaCakes118
.dll windows:4 windows x86 arch:x86

c044460de7fdbc9648f7cb24246d29b7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileSize
CloseHandle
ReadFile
SetFilePointer
CreateFileA
OutputDebugStringA
GetModuleFileNameA
Sleep
IsBadReadPtr
VirtualQuery
ExitThread
CreateThread
GlobalAlloc
GlobalFree
GetProcAddress
LoadLibraryW
ExpandEnvironmentStringsW

ws2_32

inet_ntoa
WSCGetProviderPath
WSCEnumProtocols

wininet

InternetCloseHandle
InternetOpenUrlA
InternetOpenA

msvcrt

_stricmp
_adjust_fdiv
_initterm
_onexit
__dllonexit
_strcmpi
sprintf
_beginthread
free
strncpy
malloc
strrchr
_except_handler3

Exports

Exports

WSPStartup

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 722B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ