1c2542f2238d154d68adcd4bd2a21c37_JaffaCakes118 | Triage

Sharing

General

Target

1c2542f2238d154d68adcd4bd2a21c37_JaffaCakes118
Size

28KB
MD5

1c2542f2238d154d68adcd4bd2a21c37
SHA1

6a7f9cb0918be871424bf9e5b200f02770525f5f
SHA256

83c965a03e6480c464f32ae1d03de97d72e8690576b96a681e548f3568fd50f5
SHA512

1873de6bef6cf82136b35ec75a657e913fa7155f566d60fcad7c59f05537f68b752955142386b0d34b30382ba1898bd06e88699ab64a6544f6c25279a4f940e4
SSDEEP

384:hGATncNBi3BhiyVy5PIKPw/iPxQYOK77t:bQB95PIKPw/iPxhOKl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1c2542f2238d154d68adcd4bd2a21c37_JaffaCakes118

Files

1c2542f2238d154d68adcd4bd2a21c37_JaffaCakes118
.dll windows:4 windows x86 arch:x86

3383277ad69d75a8a3bfe8d1d393f6e9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_adjust_fdiv
malloc
_initterm
free
time
memcmp
atoi
memcpy
strstr
strrchr
fopen
fseek
ftell
memset
fread
fclose
strchr
strncpy
??2@YAPAXI@Z
??3@YAXPAX@Z
_strupr
_itoa

kernel32

LoadLibraryA
CopyFileA
GetProcAddress
CreateThread
GetTempPathA
lstrcmpA
ResumeThread
lstrlenA
lstrcpyA
ExitProcess
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
GetModuleFileNameA
lstrcatA
Sleep

Sections

.text
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 878B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ