3d21bb5cb063322d358de574e52febb6_JaffaCakes118 | Triage

Sharing

General

Target

3d21bb5cb063322d358de574e52febb6_JaffaCakes118
Size

36KB
MD5

3d21bb5cb063322d358de574e52febb6
SHA1

adb7b838114fa2d7aa7cbbc8a752fde8b74bb01d
SHA256

87fffebfa1a70c1208e77785740e91f8b8198fdc3e8da5345940a420c845c89c
SHA512

f3ede55c2da1d0ad5e5a235b670bbf3d4f3eb30ee019e34343695aafb3654a09f7be375813a4f86303deb49daa5689e3659fb61b194f69a2506f96aa79e133fe
SSDEEP

384:sh30Pba3lwcPP3gKCAI0roaa6R1i69M/EHVSxTWgokamYtcIymtWApcxfZf4993g:sh5WgTvaC1rqsA1wrtWAaBZnKW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3d21bb5cb063322d358de574e52febb6_JaffaCakes118

Files

3d21bb5cb063322d358de574e52febb6_JaffaCakes118
.dll windows:4 windows x86 arch:x86

acdedac134ec85e3574db73f3c198dde

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_stricmp
_adjust_fdiv
_itoa
malloc
_initterm
free
strncpy
atoi
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
_strlwr
sprintf

user32

GetWindowTextA
GetWindowThreadProcessId
EnumWindows

ws2_32

closesocket
ntohs

kernel32

Sleep
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
OutputDebugStringA
IsBadReadPtr
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
CreateThread
GetModuleHandleA
lstrcmpA
lstrlenA

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 940B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ