7730daf47332f78672c825048e127c95_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7730daf47332f78672c825048e127c95_JaffaCakes118
Size

8KB
MD5

7730daf47332f78672c825048e127c95
SHA1

853211cb6fa36cceb1cb3f7c393519d4363d4ec1
SHA256

5e37652611b2d3e46871d8739b4c0cf87b82886a90c33ee8ea24598e288ca82e
SHA512

ca6fc8f455581da28d1a985edad98d88be2f28a98ecbf642c6860772cf4230debead87b4ca82ef5114c98c264c49a72ca946913386680922a7106e02f71c544a
SSDEEP

96:6tm6Sz2oxW2vz4aNdVWIdNNEVVawmSQJeCUG0pc5lNXSvWC5Btm75KPi:6tBhoZv0cD4AwOQPG0pc5lsvbtLPi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7730daf47332f78672c825048e127c95_JaffaCakes118

Files

7730daf47332f78672c825048e127c95_JaffaCakes118
.dll windows:4 windows x86 arch:x86

49edd5973948f18dd40e678cba2b8296

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

socket
connect
bind
recvfrom
listen
accept
WSAStartup
gethostbyname
send
htons
sendto
closesocket
select
__WSAFDIsSet
recv

wininet

InternetGetConnectedStateEx
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
InternetReadFile

kernel32

GetWindowsDirectoryA
CreateThread
Sleep
lstrcatA
lstrcmpA
lstrlenA
lstrcpyA
GlobalFree
CreateFileA
ReadFile
SetFilePointer
CloseHandle
GetFileSize
GlobalAlloc

advapi32

RegQueryInfoKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ