aa8b3c091609c5b4cbf86b3e9957e2e5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

aa8b3c091609c5b4cbf86b3e9957e2e5_JaffaCakes118
Size

6KB
MD5

aa8b3c091609c5b4cbf86b3e9957e2e5
SHA1

978ac9426481aadb997582ef0ce6969a8c4de68b
SHA256

6b30f3701252e231445b07c3b7a45fa92bfa8d1d23e68ea9a41fc379b2ae0286
SHA512

0d9d4b21da56c9ee00c081f7be9fe06273f7fe8ddc7a5ec6db0f1c4082f528d3c60354a0b6fccac0d18d3d41a558e4ac810c1b74423be242d33775adf1a9e12a
SSDEEP

96:QtSHwjdCzLDs08dLWrQc/4Wae5sqX6+W14GyMGMK4Aletv4:QsHykLIG4WbqqKDVyMxTG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa8b3c091609c5b4cbf86b3e9957e2e5_JaffaCakes118

Files

aa8b3c091609c5b4cbf86b3e9957e2e5_JaffaCakes118
.dll windows:4 windows x86 arch:x86

280d49b88ea196e29d64485f68b771fe

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetTempPathA
WriteProcessMemory
Sleep
CloseHandle
CreateThread
GetLastError
CreateMutexA
ReadProcessMemory
GetProcAddress
GetModuleHandleA

ws2_32

WSASend
getpeername
inet_ntoa
ntohs
send
recv

user32

CallNextHookEx
SetWindowsHookExA

msvcrt

_adjust_fdiv
_initterm
free
strcmp
strcpy
_strdup
strchr
fclose
fputs
fopen
strcat
strncpy
malloc
strlen
strstr

Sections

.bss
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 550B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ