63b1f9afe6aa442d30b0ce16183e965e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

63b1f9afe6aa442d30b0ce16183e965e_JaffaCakes118
Size

20KB
MD5

63b1f9afe6aa442d30b0ce16183e965e
SHA1

3c2dbeda4bd036bd703d2174c94f62b6c47ffbfb
SHA256

a3d2e592ebcc52b5701e2bb7a3c164dee635fe61837cfbaaa2738f42b355a7d3
SHA512

49aeb1b83002207f4ab4245228a2008a031721e7cadc4f9a5b1a03ea855524fd091303aa646918eb251f7cdbbb0182b23179bed0703e79a71eb30066eaadb17e
SSDEEP

384:u9Cdf+QGyRyOSFsDYGSDfJhmCfDz2egnikOPiXxj1YXzH:u9C1ttAOSyDYGSHTzDwBvYXzH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
63b1f9afe6aa442d30b0ce16183e965e_JaffaCakes118

Files

63b1f9afe6aa442d30b0ce16183e965e_JaffaCakes118
.dll windows:4 windows x86 arch:x86

4b9a5b8a4a729cc18fb71bb5a33f60a4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSACleanup
WSAStartup
recv
closesocket
send
gethostbyname
htons
socket
connect

kernel32

CreateFileA
OpenEventA
SetEvent
VirtualQuery
GetModuleFileNameA
CreateEventA
lstrcatA
lstrlenA
GetTempPathA
GetWindowsDirectoryA
GetSystemDirectoryA
lstrcmpiA
lstrcpyA
lstrcpynA
Sleep
GlobalFree
GlobalAlloc
lstrcmpA
DeleteFileA
GetTempFileNameA
CloseHandle
WriteFile
RtlUnwind
LoadLibraryA
CreateProcessA
GetLastError
GetTickCount
FindClose
FindFirstFileA
FindNextFileA
MoveFileA
SetFileTime
ExitProcess
CreateThread

user32

SetWindowsHookExA
CallNextHookEx
SendMessageA
CharLowerA
wsprintfA

advapi32

RegCreateKeyA
RegQueryValueExA
RegCloseKey

Exports

Exports

Activate

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 570B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ