5bc1bc055910af75539ce07266b6a42e_JaffaCakes118 | Triage

Sharing

General

Target

5bc1bc055910af75539ce07266b6a42e_JaffaCakes118
Size

28KB
MD5

5bc1bc055910af75539ce07266b6a42e
SHA1

b7ebce0a8b23bf53ae3054ff510e0f7b3a108402
SHA256

6b3b3bdda9f9e19146abd8e417b6b5a995e525f31eedf88d83f1734ea0832daa
SHA512

ebcee855fc97eb0edf6054239e38de9f015b638f854aaab109419409e7a88a0a87af199de85e07dd901baa130fc561a6b6e50db491e39c6bff36399ecf76390d
SSDEEP

384:j0HFnc6irjeXH8y4PmPqhP9TZKoK73jJk:jEFtif+4PmPqhP917Kbje

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5bc1bc055910af75539ce07266b6a42e_JaffaCakes118

Files

5bc1bc055910af75539ce07266b6a42e_JaffaCakes118
.dll windows:4 windows x86 arch:x86

3383277ad69d75a8a3bfe8d1d393f6e9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_adjust_fdiv
malloc
_initterm
free
time
memcmp
atoi
memcpy
strstr
strrchr
fopen
fseek
ftell
memset
fread
fclose
strchr
strncpy
??2@YAPAXI@Z
??3@YAXPAX@Z
_strupr
_itoa

kernel32

LoadLibraryA
CopyFileA
GetProcAddress
CreateThread
GetTempPathA
lstrcmpA
ResumeThread
lstrlenA
lstrcpyA
ExitProcess
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
GetModuleFileNameA
lstrcatA
Sleep

Sections

.text
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 878B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ