8ad230af066b6a4c708a75040e5dd5f9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8ad230af066b6a4c708a75040e5dd5f9_JaffaCakes118
Size

32KB
MD5

8ad230af066b6a4c708a75040e5dd5f9
SHA1

f92e193958552d0d935418c8b10bdcc7420af429
SHA256

d10624ddbd735f786351b716c57b802b0831ff1c22efa3032353ebf4eb50c1c1
SHA512

64a5ade5232574983b6fd2d4f6a6929c87395b7e9b72178b7c882981198c57126d96500db8b69a5f329d8adfbf8b22006a4813132fa9551347cf34bfe6152d91
SSDEEP

384:TWWPN47LHIB0C9uOVPpqXaPDjHjmq5jwR4WDCrD4r1LBMw4cNv:TWWPxKKdPDjHjmkj7WmrD4xLBH4cd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8ad230af066b6a4c708a75040e5dd5f9_JaffaCakes118

Files

8ad230af066b6a4c708a75040e5dd5f9_JaffaCakes118
.dll windows:4 windows x86 arch:x86

ce3109d55eb4129aeaa4986cae91e546

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetWindowTextA
GetWindowThreadProcessId
EnumWindows

ws2_32

closesocket
ntohs

msvcrt

strchr
srand
_initterm
malloc
_adjust_fdiv
_itoa
memcmp
atoi
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
rand
_strlwr
free

kernel32

Sleep
CreateThread
CreateEventA
WaitForSingleObject
GetTickCount
SetEvent
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
lstrcmpA
lstrlenA
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
GetModuleHandleA

Sections

.text
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ