402e56a7b110dcf4dd2b412412d6310c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

402e56a7b110dcf4dd2b412412d6310c_JaffaCakes118
Size

28KB
MD5

402e56a7b110dcf4dd2b412412d6310c
SHA1

db2c12cf8b23b220643e3adf84f01e17872556f4
SHA256

e567b2bb6637272795b6af7fc5b55bea8d51ce8492bde04fbc8d214858209f7c
SHA512

a4a63b60767286d8413483f67b1b7646ae7b1acf40457644b75baa89a17321bcebd4468084839046211dab3700212b4f4c703d402b5d69cd9f5610f97896aa1d
SSDEEP

192:hN0iZB2jMCRnIBXEFazWJWm1EUulkkA+BIAJYur4/gKRX8q7X9Le:htmnIBXDWJtE2kfaQKRX8q7NL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
402e56a7b110dcf4dd2b412412d6310c_JaffaCakes118

Files

402e56a7b110dcf4dd2b412412d6310c_JaffaCakes118
.dll windows:4 windows x86 arch:x86

3383277ad69d75a8a3bfe8d1d393f6e9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_adjust_fdiv
malloc
_initterm
free
time
memcmp
atoi
memcpy
strstr
strrchr
fopen
fseek
ftell
memset
fread
fclose
strchr
strncpy
??2@YAPAXI@Z
??3@YAXPAX@Z
_strupr
_itoa

kernel32

LoadLibraryA
CopyFileA
GetProcAddress
CreateThread
GetTempPathA
lstrcmpA
ResumeThread
lstrlenA
lstrcpyA
ExitProcess
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
GetModuleFileNameA
lstrcatA
Sleep

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 878B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 822B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ