656b2b3818c84d8f48b427b098df1218_JaffaCakes118 | Triage

Sharing

General

Target

656b2b3818c84d8f48b427b098df1218_JaffaCakes118
Size

24KB
MD5

656b2b3818c84d8f48b427b098df1218
SHA1

3534e1eaa87a4b3400c5d181e3f917826f4a7610
SHA256

026fdb3dd6934e6a3246390a2e7cc0f054c6a97c8b600ccf9ea20e8c6426e4f5
SHA512

ec15ab02aea4fddf805a115bd539ee4ad52691f42ef88c67f4029c1e6bbb147f772765b8c0846cbf4bfc8ceba007fd8810062917e5f22b61071c8985497c0a28
SSDEEP

192:AzV8PgNJEcMSN36Ql8sd/vSkr6VZg5y5IFINcKBDSXdpOgpct5UuCb:AzWIzlbSs5vSRVZYlWSXPOgpct5LCb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
656b2b3818c84d8f48b427b098df1218_JaffaCakes118

Files

656b2b3818c84d8f48b427b098df1218_JaffaCakes118
.dll windows:4 windows x86 arch:x86

ad3425c0b7db8aa3e5aa192cde71638d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

closesocket
ntohs

msvcrt

free
_initterm
malloc
atoi
_itoa
strcmp
memcpy
strrchr
fseek
ftell
strstr
strchr
strncat
strncpy
??2@YAPAXI@Z
sprintf
??3@YAXPAX@Z
fopen
fwrite
fclose
fread
time
memset
_strupr
_strlwr
_adjust_fdiv

kernel32

Sleep
GetModuleHandleA
GlobalAlloc
GlobalLock
CreateThread
lstrlenA
LoadLibraryA
CopyFileA
GetProcAddress
GetTempPathA
lstrcpyA
ReadProcessMemory
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
GetModuleFileNameA
lstrcatA
MultiByteToWideChar
WideCharToMultiByte
ExitProcess

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 842B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ