ba5f7be141acd3f0c6c04fff1f5faa80_JaffaCakes118 | Triage

Sharing

General

Target

ba5f7be141acd3f0c6c04fff1f5faa80_JaffaCakes118
Size

24KB
MD5

ba5f7be141acd3f0c6c04fff1f5faa80
SHA1

782da600570f9eb47a2300c202a46c0cbbeb887b
SHA256

c273bddfe213020559a4403b7a872eb692703994cc65dcca508b12b6a71fe553
SHA512

8235cc67059a630a6e177b45aa4fc2ab71c73932a6da8a5e0bf99eafba91938f00bd271da21d5457da7feec964b2df57e3dc1e3d97c4423f0be9333afd623c5c
SSDEEP

192:eTa/415aEz8uk76KItzYzKuFkGS1MBpe/MQBBX4qSpct5UkGYr:R415aW8n7zI2HiTwM/XX4qSpct5QYr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ba5f7be141acd3f0c6c04fff1f5faa80_JaffaCakes118

Files

ba5f7be141acd3f0c6c04fff1f5faa80_JaffaCakes118
.dll windows:4 windows x86 arch:x86

ead0c1aec9215b0b9f0d8c6faf732620

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

closesocket
ntohs
ntohl

msvcrt

free
_initterm
strchr
_adjust_fdiv
_itoa
atoi
memcpy
strncpy
strcmp
sprintf
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
_strlwr
malloc

kernel32

Sleep
CreateThread
ExitProcess
GetModuleHandleA
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
lstrlenA
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
GetCommandLineA

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 702B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ