8952c17b14376ba01380cf4db7a3c4ed_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8952c17b14376ba01380cf4db7a3c4ed_JaffaCakes118
Size

18KB
MD5

8952c17b14376ba01380cf4db7a3c4ed
SHA1

336e87fca8ae27e84fcc9ed1b43df74d72be9747
SHA256

7bd19bc656ff3a87e852fbd55f7fcc7ebf0519277079fceed51849540d5aec34
SHA512

d155bdc49c9f1106da0861b3a9cff8d160f3bb8388a09bafd9e214eb8d29d1a18dcc9249970abeb185e0486adda3464bde1b50f6537e16563df720f60c9a997f
SSDEEP

384:ZfwjWbkmC7DATInzuF3r1Fa7MwljjwrzEQ:ZWEC7O3Pa7Mgjwrb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8952c17b14376ba01380cf4db7a3c4ed_JaffaCakes118

Files

8952c17b14376ba01380cf4db7a3c4ed_JaffaCakes118
.dll windows:4 windows x86 arch:x86

0da37a1127670c1efa04597e6eb003a6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSACleanup
WSAStartup
recv
closesocket
send
gethostbyname
htons
socket
connect

kernel32

CloseHandle
OpenEventA
SetEvent
VirtualQuery
CreateThread
GetTickCount
lstrcatA
lstrlenA
GetWindowsDirectoryA
GetSystemDirectoryA
lstrcmpiA
lstrcpyA
lstrcpynA
GetSystemTime
GlobalFree
GlobalAlloc
lstrcmpA
DeleteFileA
GetTempFileNameA
GetTempPathA
WinExec
GetModuleFileNameA
RtlUnwind
WriteFile
CreateFileA
CreateProcessA
GetLastError
FileTimeToSystemTime
FindClose
FindFirstFileA
GetComputerNameA
CreateMutexA
Sleep
ExitProcess

user32

SetWindowsHookExA
CallNextHookEx
SendMessageA
CharLowerA
wsprintfA

advapi32

RegCreateKeyA
RegQueryValueExA
RegCloseKey

Exports

Exports

Activate

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ