89bbd322cdf99eb20d91558c1815819f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

89bbd322cdf99eb20d91558c1815819f_JaffaCakes118
Size

24KB
MD5

89bbd322cdf99eb20d91558c1815819f
SHA1

ab5022767117d4a92f05dfba9892adeffde1e547
SHA256

e6aa110f1aae0dd1a5469f58198770a23ce9cab54b69cc8a35815c60495482c8
SHA512

f4591f995b704c7d10be473974a3c67a45d9032b50c2ef46736e01db03e3c06c86dec91e75ae71fdf640dbdadf1026d7ce3a1a8241c7352e1429d5fa3d0049a0
SSDEEP

192:wBrcSSbigUfMJmRr/JgTuHhhzvVYN4CFhpct5UvUf1cZFNS:wBrsbNqMJ2rhgg1VYCChpct5u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
89bbd322cdf99eb20d91558c1815819f_JaffaCakes118

Files

89bbd322cdf99eb20d91558c1815819f_JaffaCakes118
.dll windows:4 windows x86 arch:x86

5b575f9d44d630b4f1402be8becbddf2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetWindowTextA
FindWindowExA
FindWindowA
EnumChildWindows
EnableWindow

ws2_32

ntohs
closesocket

msvcrt

atoi
memcpy
srand
free
_initterm
malloc
_strlwr
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
rand
fopen
fwrite
fclose
fread
time
memset
_itoa
strcmp
_adjust_fdiv

kernel32

GetModuleFileNameA
GetTempPathA
GetModuleHandleA
GetTickCount
lstrlenA
LoadLibraryA
CopyFileA
GetProcAddress
IsBadReadPtr
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
Sleep
lstrcmpA
CreateThread

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ