877c68cccb2b45e1deb5114265643d77_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

877c68cccb2b45e1deb5114265643d77_JaffaCakes118
Size

28KB
MD5

877c68cccb2b45e1deb5114265643d77
SHA1

da133357e12b116ef6026c4b85b267262ae652dd
SHA256

2b65e8aca9fce728a2ac493cca351bad948ab82cb63deaba4da353463ca092e6
SHA512

eded95d5071f339182568fc01736b012e37db841b3f54ebfa177b3a5437e339c60612ba73ca34530768f0d35d4c41f136f8a44775f813a33dd0888b15f400809
SSDEEP

384:Qn5rAQKO0nQc8GXpJsSJbOca67G/gDANVh8S:Qn5cQKO0d8G7sSnzAzh8S

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
877c68cccb2b45e1deb5114265643d77_JaffaCakes118

Files

877c68cccb2b45e1deb5114265643d77_JaffaCakes118
.dll windows:4 windows x86 arch:x86

bbc50dbbc8b32cec1dc493079a1c0fb4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

free
_initterm
malloc
atoi
memcpy
strcmp
strstr
strrchr
fseek
ftell
??2@YAPAXI@Z
strchr
strncpy
??3@YAXPAX@Z
fopen
fwrite
fclose
fread
time
_adjust_fdiv
memset
_strlwr
_itoa

kernel32

Sleep
CreateThread
LoadLibraryA
CopyFileA
GetProcAddress
GetTempPathA
lstrcmpA
lstrcpyA
lstrlenA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
GetModuleFileNameA
lstrcatA
ExitProcess

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 778B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ