4013b514c3d44d65c8abef12660f427c_JaffaCakes118 | Triage

Sharing

General

Target

4013b514c3d44d65c8abef12660f427c_JaffaCakes118
Size

24KB
MD5

4013b514c3d44d65c8abef12660f427c
SHA1

ec9e96f81a52ec4fa3d9daa8af7936e9ef8dbf12
SHA256

85921c9355a9967c4ff3ab9c9b170c78587db5e14f005da729ced05b2f27fd45
SHA512

60fc6c85be260250599199447a41502b772f75897dfce539feafde5b179cadab1b9efb21c7d9bd676b258b0c3336d8e63e5bffc3570055641fbf4183cae45f35
SSDEEP

192:f+qTygt+8iURbbh6kuAT1sqnUt32vQy0PQVDBpct5U8/O:GW9RbAaTSkU9PQVDBpct5XO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4013b514c3d44d65c8abef12660f427c_JaffaCakes118

Files

4013b514c3d44d65c8abef12660f427c_JaffaCakes118
.dll windows:4 windows x86 arch:x86

1dd2cb4746509cab5130e86cdc2c8f3d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_adjust_fdiv
malloc
_initterm
free
atoi
memcpy
strncpy
strchr
strcmp
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
_itoa
_strlwr

kernel32

Sleep
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
CreateThread
lstrcmpA
lstrlenA
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
ExitProcess

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ