af7b82587acc6ca23c3e58d7859277b1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

af7b82587acc6ca23c3e58d7859277b1_JaffaCakes118
Size

24KB
MD5

af7b82587acc6ca23c3e58d7859277b1
SHA1

b5374c8102387938aee1a1ed6fabeafa2b49ccd1
SHA256

d5aa7e02bd022c45be6c5fb6f481b6847e45b4de5a1b47221a248a14d2972009
SHA512

b240c3af9dce40bbada3a385a47480b1ebf35439bd7498d2e2d94495821501a1ca20c1470e05ab00b4005ee4b60a89a20e62d5cf9369246fe5297cf559be6da0
SSDEEP

192:MBrcSSbigUfMJCr/JgTuHhhzvVYN4CFhpct5UvUf1cZYeNS:MBrsbNqMJCrhgg1VYCChpct5Q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af7b82587acc6ca23c3e58d7859277b1_JaffaCakes118

Files

af7b82587acc6ca23c3e58d7859277b1_JaffaCakes118
.dll windows:4 windows x86 arch:x86

5b575f9d44d630b4f1402be8becbddf2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetWindowTextA
FindWindowExA
FindWindowA
EnumChildWindows
EnableWindow

ws2_32

ntohs
closesocket

msvcrt

atoi
memcpy
srand
free
_initterm
malloc
_strlwr
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
rand
fopen
fwrite
fclose
fread
time
memset
_itoa
strcmp
_adjust_fdiv

kernel32

GetModuleFileNameA
GetTempPathA
GetModuleHandleA
GetTickCount
lstrlenA
LoadLibraryA
CopyFileA
GetProcAddress
IsBadReadPtr
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
Sleep
lstrcmpA
CreateThread

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ