7841b6b4474a9fcee17b4af735afc4a9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7841b6b4474a9fcee17b4af735afc4a9_JaffaCakes118
Size

28KB
MD5

7841b6b4474a9fcee17b4af735afc4a9
SHA1

145332e251bcfc20b05a29c792c8fc59cbe146b0
SHA256

1cd5f19dd2b4cab7f22b6f1a2f24483372c35eeb7362a059835e1e1c21b488dc
SHA512

ecb138577cce8c2ce7e20aea1dd28ed77f3f4320b9c17c3f7ea8ee56330e48f8526659bcfc64cbfe736844c94464358942518b9750ed239843491c5f4b3c6249
SSDEEP

384:8im9bfdATt7QkajLz7TXAKAVAZb4Kgpct5SooaZ:ZifGTpaj7UKkAZb4Pat5YaZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7841b6b4474a9fcee17b4af735afc4a9_JaffaCakes118

Files

7841b6b4474a9fcee17b4af735afc4a9_JaffaCakes118
.dll windows:4 windows x86 arch:x86

d4c6718d56bdc5d19b067282ce7b9d97

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

closesocket
ntohs
ntohl

msvcrt

free
_initterm
strchr
_adjust_fdiv
_itoa
atoi
memcpy
strncpy
strcmp
sprintf
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
_strlwr
malloc

kernel32

Sleep
GetCommandLineA
ExitProcess
GetModuleHandleA
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
lstrlenA
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
CreateThread

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 758B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ