624db482d11c9166541fa99f2c60d90e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

624db482d11c9166541fa99f2c60d90e_JaffaCakes118
Size

28KB
MD5

624db482d11c9166541fa99f2c60d90e
SHA1

f3b441417c0a5bc0af0c4f2424634373f5d41517
SHA256

c7eceafb1435d1c6158979db610e1a9311a958482f19d92f2d15fa75b38203a2
SHA512

ca7571d3b57bce2782ba6c2997d83f02493bfe7f422e44ff8b077ea8d8d15ce5af153872846ef51196f8c5302dd505d29666ae31ca814b410f432418ee894b6d
SSDEEP

768:wj+duX3jj1JR92j7/o0LYrHC4DdAXZmJ7dB:JIX3jj1JR92nY4w

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
624db482d11c9166541fa99f2c60d90e_JaffaCakes118

Files

624db482d11c9166541fa99f2c60d90e_JaffaCakes118
.dll windows:4 windows x86 arch:x86

63e51918d36b1e0a4a31e41ea6dff054

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

closesocket
ntohs

msvcrt

malloc
_initterm
_itoa
free
strchr
atoi
memcpy
strncat
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
_strlwr
_adjust_fdiv

kernel32

GetModuleHandleA
lstrlenA
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
lstrcpyA
CreateProcessA
Sleep
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
CreateThread

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 930B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ