959be91f5aacada14927db4b08509cf9_JaffaCakes118 | Triage

Sharing

General

Target

959be91f5aacada14927db4b08509cf9_JaffaCakes118
Size

36KB
MD5

959be91f5aacada14927db4b08509cf9
SHA1

d1a16750b8459f414676c6172633129e7a146830
SHA256

4514d8f7f15f0acef2cbedb0c0187c84e9c6df8e2e1a97915fa226bd3d24f67b
SHA512

fc26c39c6d7e26ae2acdc440d2fa96823bbed45f4e3b4ec3b2935194c116a3b3015ea3d5b63bc2545ab2f6569cb0f27a2b5c5e89be3cffa7f6f5c7c4ef386c00
SSDEEP

384:b30Pba3dp3de3ea+PK3oSvNS3+o8WI4Vte/Qpct5t9999+uCo:b5xe3eafPvNSD8W9w/Qat5Yu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
959be91f5aacada14927db4b08509cf9_JaffaCakes118

Files

959be91f5aacada14927db4b08509cf9_JaffaCakes118
.dll windows:4 windows x86 arch:x86

3e91566ad3f63f49469cae8d67653c4c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_adjust_fdiv
_stricmp
_strlwr
malloc
_itoa
_initterm
free
strncpy
strchr
atoi
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
sprintf

user32

EnumWindows
GetWindowTextA
GetWindowThreadProcessId

ws2_32

closesocket
ntohs

kernel32

Sleep
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
CreateThread
GetModuleHandleA
lstrcmpA
lstrlenA

Sections

.text
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 876B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ