63d61132a7552367b28b0682f32cdd56_JaffaCakes118 | Triage

Sharing

General

Target

63d61132a7552367b28b0682f32cdd56_JaffaCakes118
Size

28KB
MD5

63d61132a7552367b28b0682f32cdd56
SHA1

204f764c57c342a309f7acda81783d710741d3db
SHA256

da52a29fccdc23750a57ee61ef8a1476f1ecb3eb2d6a2d5b28c0b8d7cd71a640
SHA512

315cd8727bb74bb9f08dabdb4a9b24ac17b12468a9ee7fc7f3d868bb9705a0a34c43a3e8444abbb7216c22d2357afbff7d7ce9b72d07c2bb7de8cb67e1d2d5e5
SSDEEP

384:j5UXJzuzuvoPjhfeewtAlm0Xs1DM29cwzpct5QP4:j5U5uuwPjIJAK5M29cCat5r

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
63d61132a7552367b28b0682f32cdd56_JaffaCakes118

Files

63d61132a7552367b28b0682f32cdd56_JaffaCakes118
.dll windows:4 windows x86 arch:x86

e4074b8d0f2a4a94f9805ae675cd3aea

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

closesocket
ntohs

msvcrt

_initterm
malloc
free
_itoa
atoi
strcmp
memcpy
strstr
strrchr
fseek
ftell
strchr
strncpy
??2@YAPAXI@Z
sprintf
??3@YAXPAX@Z
fopen
fwrite
fclose
fread
time
memset
_strupr
_strlwr
_adjust_fdiv

kernel32

Sleep
GetModuleHandleA
GlobalAlloc
GlobalLock
CreateThread
lstrlenA
LoadLibraryA
CopyFileA
GetProcAddress
GetTempPathA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
GetModuleFileNameA
lstrcpyA
MultiByteToWideChar
WideCharToMultiByte
ExitProcess

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 860B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ