a1a6ebb1bcd15e4364c9c0922eab9d69_JaffaCakes118 | Triage

Sharing

General

Target

a1a6ebb1bcd15e4364c9c0922eab9d69_JaffaCakes118
Size

28KB
MD5

a1a6ebb1bcd15e4364c9c0922eab9d69
SHA1

d1d39aef3cce408b2a605b994376dc15897cbd1f
SHA256

20e1b700040415cbac2a20c69fb468d987503ee0c0f2ce666e52e8647ff3129d
SHA512

682747406778cdf974f76430a4959a344cb5cf810e4123d6972add8814fbad4980dc26e5f678433cbcae7839b5771208618faaf81bf0c6a60eefd142909c3c59
SSDEEP

192:eDwXrgi7JtOQTtNAMKbUhKZOqnJrwyKQx0Ze4qge:eDwXr37Gq09MVDO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a1a6ebb1bcd15e4364c9c0922eab9d69_JaffaCakes118

Files

a1a6ebb1bcd15e4364c9c0922eab9d69_JaffaCakes118
.dll windows:4 windows x86 arch:x86

0815cdbf8dc115dddbf78e419dc27759

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord1158
ord2818
ord858
ord4278
ord860
ord2764
ord540
ord800
ord537
ord939

msvcrt

_adjust_fdiv
malloc
_initterm
free
?terminate@@YAXXZ
_except_handler3
_onexit
__dllonexit
__CxxFrameHandler

kernel32

CreateThread
OpenProcess
GetCurrentProcessId
GetModuleFileNameA
Sleep
ReadProcessMemory
CloseHandle

user32

UnhookWindowsHookEx
DispatchMessageA
TranslateMessage
GetMessageA
SetWindowsHookExA
CallNextHookEx

ws2_32

recv
closesocket
send
connect
htons
socket
gethostbyname
WSAStartup

Sections

.text
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARDAT
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ