3cc470f424cc8df3ed20ab5737d024f3_JaffaCakes118 | Triage

Sharing

General

Target

3cc470f424cc8df3ed20ab5737d024f3_JaffaCakes118
Size

19KB
MD5

3cc470f424cc8df3ed20ab5737d024f3
SHA1

3bb564bb5a5e7f0095bacbcc3e07e10000ab7228
SHA256

6406d94c9eb571e84a0a10a5b6e18e778a87b73ae35bf2f7f616bbb9f4aaaa43
SHA512

cb189070f59af92c555b490d522023f2a54face9d4a2f0100d606969f5e57734296f316322653239eaf9bdbe4c0dc700bee4eb09b81e5118d54b6b90c0184060
SSDEEP

384:7uH2OxyqFK5ZHSYPoM7XyB3o+GOQN7gSsmoCT/ulF4L0C8eFGsWMoWlJV:7uWOwPPBblqdStV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3cc470f424cc8df3ed20ab5737d024f3_JaffaCakes118

Files

3cc470f424cc8df3ed20ab5737d024f3_JaffaCakes118
.dll windows:4 windows x86 arch:x86

cca36a71f1855a58c899b15d67b59c4e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetPrivateProfileIntA
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetEnvironmentVariableA

advapi32

DuplicateTokenEx
CreateProcessAsUserA

ws2_32

WSAGetLastError
shutdown
socket
htons
connect
setsockopt
select
__WSAFDIsSet
send
gethostbyname
closesocket
WSAStartup
WSACleanup
recv

shlwapi

PathFileExistsA

msvcrt

_adjust_fdiv
malloc
_initterm
free
__CxxFrameHandler
fseek
ftell
fread
strcspn
_except_handler3
fopen
fwrite
??2@YAPAXI@Z
??3@YAXPAX@Z
fclose

Exports

Exports

Print32

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ