439bb46fe80d7d343a5b8758ff6e8ce3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

439bb46fe80d7d343a5b8758ff6e8ce3_JaffaCakes118
Size

11KB
MD5

439bb46fe80d7d343a5b8758ff6e8ce3
SHA1

688704015b705a3583f272b68a1cab8034999164
SHA256

0d74f93f641c4dae0f3ad1d60529462c8e4dcae385c2cb31434f075c018e95f1
SHA512

64cdc1a41634b6714798cde6412ce94317cb88fcd5b1288b9f958a6f0fecd541fe57687da8ea0711dc88a1bfba72cd6f5c9cd84fbd11717b432f780393f122ba
SSDEEP

192:fVREgxEDRfBT9+jMgj/jQ7p3o4O+G1z/joF2pfS17YTxI1NdfR:frFxEDR+QW/j+hX0q2pfSulIZR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
439bb46fe80d7d343a5b8758ff6e8ce3_JaffaCakes118

Files

439bb46fe80d7d343a5b8758ff6e8ce3_JaffaCakes118
.dll windows:4 windows x86 arch:x86

6118c065fb7d0dad2ced81cf89fb21ab

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

EndDialog

kernel32

GetTickCount
HeapAlloc
HeapFree
IsValidCodePage
LocalFlags
OpenMutexA
GetProcessHeap
RtlZeroMemory
SleepEx
lstrcatA
lstrcpyA
lstrcpynA
GetModuleHandleA
CloseHandle
GetModuleFileNameA
CreateThread

advapi32

RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegCloseKey

ws2_32

WSAStartup
accept
bind
closesocket
connect
gethostbyname
ioctlsocket
listen
recv
select
send
setsockopt
shutdown
socket

ntdll

RtlExitUserThread

Exports

Exports

rimlofb

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 982B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 634B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ