a3eddc9f8229ee74a10e54698fd4045c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a3eddc9f8229ee74a10e54698fd4045c_JaffaCakes118
Size

24KB
MD5

a3eddc9f8229ee74a10e54698fd4045c
SHA1

fd81dd50cec2a3a40dd5a6849d7ea40b11dd5aa6
SHA256

9416f7c30241846230e9cb735f5421a86392573171db6eca211e61511cca901c
SHA512

5c3dc66f0a9f16b40528739c6c78aee18cb042f867a3f1a4dbb169a0ed7658866b9cf3edfd0d87d2734834ac88e71a5a37da4831132e3ae9d0febcd2496f54dd
SSDEEP

192:oZVzbnM6uKMlnTzENw2zmZSmFhpct5UgJ0w:oZZbM62lnTAMZSehpct5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a3eddc9f8229ee74a10e54698fd4045c_JaffaCakes118

Files

a3eddc9f8229ee74a10e54698fd4045c_JaffaCakes118
.dll windows:4 windows x86 arch:x86

5b575f9d44d630b4f1402be8becbddf2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetWindowTextA
FindWindowExA
FindWindowA
EnumChildWindows
EnableWindow

ws2_32

ntohs
closesocket

msvcrt

atoi
memcpy
srand
free
_initterm
malloc
_strlwr
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
rand
fopen
fwrite
fclose
fread
time
memset
_itoa
strcmp
_adjust_fdiv

kernel32

GetModuleFileNameA
GetTempPathA
GetModuleHandleA
GetTickCount
lstrlenA
LoadLibraryA
CopyFileA
GetProcAddress
IsBadReadPtr
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
Sleep
lstrcmpA
CreateThread

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ