35c924a4d147416c8437c8af7ba07b5d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

35c924a4d147416c8437c8af7ba07b5d_JaffaCakes118
Size

20KB
MD5

35c924a4d147416c8437c8af7ba07b5d
SHA1

a0b7884a33010a2f5c3f06e142be39e0b3548ead
SHA256

2dc09a37477bd19feb7255548fc7646396c634ac5502442723d103841634ad41
SHA512

8dab99e012816fcf7aff788753cb921c94ea7e04426eb1ddb9c567800354e8bfdf2efbe43ff103f49c6ff6329461a99c932a3b026c7d2b1d055a363dac4996ca
SSDEEP

96:lsrZ8vRL10mxVozYrQy9rFvE8IlL2tqMnme4Le4ofYW3N+q:lsFgRVrtklYUBohdl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
35c924a4d147416c8437c8af7ba07b5d_JaffaCakes118

Files

35c924a4d147416c8437c8af7ba07b5d_JaffaCakes118
.dll windows:4 windows x86 arch:x86

f9e08b693b4a645908b716a7bb5e3ec2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_adjust_fdiv
malloc
_initterm
free
sprintf
strtok
strstr

kernel32

GetFileSize
GetModuleFileNameA
CreateFileA
SetFilePointer
ReadFile
GetComputerNameA
GetVersionExA
ReadProcessMemory
Sleep
OpenProcess
CloseHandle
CreateThread

user32

FindWindowExA
GetWindowThreadProcessId
FindWindowA
GetWindowTextA
GetWindow

ws2_32

recv
closesocket
send
connect
htons
socket
gethostbyname
WSAStartup

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 790B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 464B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ