2147a4d0215f4ed119429925dd70a273_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2147a4d0215f4ed119429925dd70a273_JaffaCakes118
Size

23KB
MD5

2147a4d0215f4ed119429925dd70a273
SHA1

fc16131e39a762f94a9586e8dbad97b863ff83d5
SHA256

bcaf397e68c22dfccb2b5d61da39c24d721dddadc2f5bf4823bed9622a245b95
SHA512

fa9523189fa53329faf0e3002bbd05f3ffc62bfd596c9b02e7219f9a7163f044a93117e4988d7cef981300f13a7c59920a338e0bce685762e2ab1ab5796393fe
SSDEEP

384:XNuTcPEKHuLzJxQ/cLI+JXf26aTl91V/0eK+xu6tngNlf6pWH1O1:XNuTcPEKHawkjXf26aTr1V/RxHFulhHY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2147a4d0215f4ed119429925dd70a273_JaffaCakes118

Files

2147a4d0215f4ed119429925dd70a273_JaffaCakes118
.dll windows:4 windows x86 arch:x86

ac9dd75b8550cdc38afde21a8906add0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

RtlImageNtHeader
strchr
_stricmp
ZwOpenEvent
atoi
_snprintf
strstr
strncmp
sprintf
_chkstk
memcpy

msvcrt

realloc
strtok
malloc
free

kernel32

GetLastError
LocalAlloc
LoadLibraryA
GetProcAddress
InterlockedExchange
GetTempFileNameA
CreateFileA
GetFileSize
Sleep
ReadFile
CloseHandle
DeleteFileA
HeapFree
GetProcessHeap
MoveFileExA
FreeLibrary
WaitForSingleObject
SetEvent
VirtualAlloc
GetSystemTimeAsFileTime
GetModuleFileNameA
GetModuleHandleA
LoadLibraryExA
VirtualProtect
GetTempPathA
CreateThread
GetVolumeInformationA
HeapAlloc
RaiseException

Sections

.text
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ