83f082c07e743a2c4813d3110cdba6fa_JaffaCakes118 | Triage

Sharing

General

Target

83f082c07e743a2c4813d3110cdba6fa_JaffaCakes118
Size

21KB
MD5

83f082c07e743a2c4813d3110cdba6fa
SHA1

a0d82bcfd55e21530b4c542c5327fec9d01503c8
SHA256

be25273dc4c0d63104b7de4165b1a785c1c673d8f26254cf9a4c8b3f83641fa7
SHA512

fe8fb1b2b5ca9d1bec06881e9fe5ac955ed7aae725aef99c3d36215f6785e29bd3d1848d841fda68c06e7b2b348b07b3c0c02365173246e961d5025b00cf83a4
SSDEEP

384:wrSdRsvv0bntLdNeDGotWVTJHJup23r1FVX6666666666666G666R6Z26ZZ6Z66B:Zsvv0ZLneDGu+L3/u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
83f082c07e743a2c4813d3110cdba6fa_JaffaCakes118

Files

83f082c07e743a2c4813d3110cdba6fa_JaffaCakes118
.dll windows:4 windows x86 arch:x86

48cc11b5eeb642812df5e9171aa6b7ec

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSACleanup
WSAStartup
recv
closesocket
send
gethostbyname
htons
socket
connect

kernel32

CloseHandle
OpenEventA
SetEvent
VirtualQuery
CreateThread
GetTickCount
lstrcatA
lstrlenA
GetWindowsDirectoryA
GetSystemDirectoryA
lstrcmpiA
lstrcpyA
lstrcpynA
GetSystemTime
GlobalFree
GlobalAlloc
lstrcmpA
DeleteFileA
GetTempFileNameA
GetTempPathA
WinExec
GetModuleFileNameA
RtlUnwind
WriteFile
CreateFileA
CreateProcessA
GetLastError
FileTimeToSystemTime
FindClose
FindFirstFileA
GetComputerNameA
Sleep
CreateMutexA
ExitProcess

user32

SetWindowsHookExA
CallNextHookEx
SendMessageA
CharLowerA
wsprintfA

advapi32

RegCreateKeyA
RegQueryValueExA
RegCloseKey

Exports

Exports

Activate

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 518B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ