693fd624ab6c60322cebdac42b793969_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

693fd624ab6c60322cebdac42b793969_JaffaCakes118
Size

24KB
MD5

693fd624ab6c60322cebdac42b793969
SHA1

6715c04889f0cb6f3a89014221581cf57c18a0b2
SHA256

1b840f25347a25d900c70d5f5270064c52fb17ef8b4d2dd501dbb0cf40b762fa
SHA512

bdd895d63d3a71af521e29367b86da84038e899be89b365cf1bfc5c48c56f9d13adf994fa4d00eeb5271ba4adf11c06b38b410e81d9e055ebffdfc39fcbc9fc5
SSDEEP

192:1QJElNqROmvUpIzk5HePfoCNN7FHvo6tUcpct5Ujw:1i3ROVpIzOHe3fNN7LUcpct5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
693fd624ab6c60322cebdac42b793969_JaffaCakes118

Files

693fd624ab6c60322cebdac42b793969_JaffaCakes118
.dll windows:4 windows x86 arch:x86

bfd74c6184519ca5dbce81afa7924f1f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_adjust_fdiv
malloc
_initterm
free
atoi
memcpy
strncpy
strchr
strcmp
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
_strlwr
_itoa

kernel32

GetModuleHandleA
lstrlenA
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
CreateThread
GetTempPathA
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
Sleep

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 866B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 598B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ