35499d51cbb229b6a46ecef26404f38c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

35499d51cbb229b6a46ecef26404f38c_JaffaCakes118
Size

24KB
MD5

35499d51cbb229b6a46ecef26404f38c
SHA1

df994187e41016294291a0b419b982b3b9785a68
SHA256

0979e2f525cfdf6307bbb31af8eec6e7026a5fba3b07e046fa9195c3d8a4d494
SHA512

02960cab4ca289d5e841e3726cabdcaea61a998ce0504bccd49de796e0fae265c068f2f08151a7d69ef301af8e22b49c477247fd595e2f477eb82f75d312c75c
SSDEEP

384:17e4/XijlCWSeiroQhFfUnaBogTC9pct5Qr1LBMwTSYz:1nysWSF3TUYdC9at5QxLBHTSY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
35499d51cbb229b6a46ecef26404f38c_JaffaCakes118

Files

35499d51cbb229b6a46ecef26404f38c_JaffaCakes118
.dll windows:4 windows x86 arch:x86

8b50ab735deb045c2eb3bc4f251ed4c9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetWindowTextA
GetWindowThreadProcessId
EnumWindows

ws2_32

closesocket
ntohs

msvcrt

strchr
_initterm
malloc
_adjust_fdiv
_itoa
srand
atoi
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
rand
_strlwr
free

kernel32

GetModuleHandleA
LoadLibraryA
WaitForSingleObject
GetTickCount
SetEvent
Sleep
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
lstrcmpA
lstrlenA
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
CreateThread

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 882B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ