8e42dc54583b71bb0547b1510951c0a1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8e42dc54583b71bb0547b1510951c0a1_JaffaCakes118
Size

18KB
MD5

8e42dc54583b71bb0547b1510951c0a1
SHA1

5f4e30e77a022dd11f9cb459961eb014dd2f0374
SHA256

0df577075e59bf78d766a6cf712379fd96efb3c94ea553184ba89b9e32b6aff1
SHA512

d3afa628339b472cc9d9e5dc51386cb2d47cccfedac89efc07fb5208acfb6b4e7590d274da52473ddd3d98d4daebe59a72350ee05fc4f31567354acb8a2afb67
SSDEEP

384:L4TdRDL/rdZx/nn5IFNBd9F0ewLBtom/l8pTrLYyUbGx2rVE1Y+Stv:L4TrnxnGFzGew4m/uC9mY+Stv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e42dc54583b71bb0547b1510951c0a1_JaffaCakes118

Files

8e42dc54583b71bb0547b1510951c0a1_JaffaCakes118
.dll windows:4 windows x86 arch:x86

cb6cdbc588615fd6c4b6c71c44621fa9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSACleanup
WSAStartup
recv
closesocket
send
gethostbyname
htons
socket
connect

kernel32

CloseHandle
OpenEventA
SetEvent
VirtualQuery
GetModuleFileNameA
GetTickCount
lstrcatA
lstrlenA
GetTempPathA
GetWindowsDirectoryA
GetSystemDirectoryA
lstrcmpiA
lstrcpyA
lstrcpynA
GlobalFree
GlobalAlloc
lstrcmpA
RtlUnwind
WriteFile
CreateFileA
CreateProcessA
GetLastError
Sleep
ExitProcess
CreateThread

user32

SetWindowsHookExA
CallNextHookEx
SendMessageA
CharLowerA
wsprintfA

advapi32

RegCreateKeyA
RegQueryValueExA
RegCloseKey

Exports

Exports

Activate

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 412B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ