348d0627b7567df824d7cf39bfd53e28_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

348d0627b7567df824d7cf39bfd53e28_JaffaCakes118
Size

24KB
MD5

348d0627b7567df824d7cf39bfd53e28
SHA1

73bc2895ff897d9dc96e51e5f801147c390e775e
SHA256

9401ec3f339794cdd8f698e7cec43a21f8b54dfaabe137746cc814a1dbe8a381
SHA512

3f01aac0253f207c99a2570636012a47511ffaae02353fd596048e6671ae44dedb38c795d9327282ed733df8e91252efec48c24c876d305d18823a4e2a6c40ea
SSDEEP

192:0qLcoVsR6D2HAlmusBIovouMCeWHaCaJzAypct5UFFu95LkC6dGcNc:0qFVsAD2qmvIWWCP6f1Aypct5X5In

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
348d0627b7567df824d7cf39bfd53e28_JaffaCakes118

Files

348d0627b7567df824d7cf39bfd53e28_JaffaCakes118
.dll windows:4 windows x86 arch:x86

df7e7367b810b262a31dd4452638304d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_adjust_fdiv
memset
malloc
_initterm
free
memcmp
atoi
memcpy
strstr
strrchr
fseek
ftell
strchr
strncpy
??2@YAPAXI@Z
??3@YAXPAX@Z
fopen
fwrite
fclose
fread
time
_strlwr
_itoa

kernel32

ExitProcess
Sleep
LoadLibraryA
CopyFileA
GetProcAddress
CreateThread
GetTempPathA
lstrcmpA
ResumeThread
lstrlenA
lstrcpyA
CreateRemoteThread
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
GetModuleFileNameA
lstrcatA

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 956B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 754B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ