3d6f760b2bc53802ec827786321442ac_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3d6f760b2bc53802ec827786321442ac_JaffaCakes118
Size

8KB
MD5

3d6f760b2bc53802ec827786321442ac
SHA1

e45a212c8f560ab8073f531397eb22636663773a
SHA256

634ffa498d9003e055ebf4ec49e8c02753bd1330cc558ae738dd03161ad93951
SHA512

05ed3b83a47b4681aa643634413bb3bd6deb7718ef5fa446a1336a31f002f0bcd8dba23325846f7a250c83f137340f056b843fad92546de1a20759ebc73c2214
SSDEEP

96:zLYbRpAEmJQnLi+gA1mJxn1vHyfQSAoLpPLpUD0o9+GGsGGGC5t:zMbRXJgBxxHyfQSHL1LOAo9+GGsGGGS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3d6f760b2bc53802ec827786321442ac_JaffaCakes118

Files

3d6f760b2bc53802ec827786321442ac_JaffaCakes118
.dll windows:4 windows x86 arch:x86

44d54517faba6bc6eb0e8c9c3e20868a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
lstrlenA
Process32Next
lstrcatA
Process32First
CreateToolhelp32Snapshot
WinExec
DeleteFileA
WriteFile
lstrcmpA
CreateFileA
GetSystemDirectoryA
Sleep
lstrcpyA
CreateThread
GetStringTypeW
GetStringTypeA
RtlUnwind
MultiByteToWideChar
GetProcessHeap
HeapAlloc

ws2_32

socket
gethostbyname
inet_addr
htons
WSAStartup
connect
gethostname
send
recv
closesocket
WSACleanup
shutdown

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 710B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 416B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ