2734722ce64d188c8e2a57d831ce1b12_JaffaCakes118 | Triage

Sharing

General

Target

2734722ce64d188c8e2a57d831ce1b12_JaffaCakes118
Size

8KB
MD5

2734722ce64d188c8e2a57d831ce1b12
SHA1

c6a32c220899f1f42fcaabe725058e8f20663604
SHA256

603980369b0770c17148159f66b6af37c8c47d10711c72011b9b420edd537669
SHA512

9d614adc63d4c6cd6152554d5c8e867b74f27b19f5f3b7375ee21d96709f2af5c81a2c38ff563b535d8a18d1fddb4b1cd32157df9efe82d5a27fade98505c7a7
SSDEEP

192:wwX0IJcDsS2Jis4Agi8rQXE0CVDI5diFK:wU3ZspDG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2734722ce64d188c8e2a57d831ce1b12_JaffaCakes118

Files

2734722ce64d188c8e2a57d831ce1b12_JaffaCakes118
.dll windows:4 windows x86 arch:x86

f45be0c156e730a46d07f8a01f85d813

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
Process32Next
GetCurrentProcessId
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
WriteProcessMemory
lstrcpynA
lstrcmpW
lstrcpynW
lstrcmpA
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
GetProcAddress
GetModuleHandleA
VirtualAllocEx
GetSystemDirectoryA
OpenProcess
Sleep
CreateThread
ReadProcessMemory
LoadLibraryA

wininet

HttpSendRequestW
HttpSendRequestA
InternetReadFile

ws2_32

WSACleanup
send
connect
gethostbyname
inet_addr
htons
socket
WSAStartup

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 866B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 989B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 492B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ