bf80dbf969b73790253f683cd723fd71_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bf80dbf969b73790253f683cd723fd71_JaffaCakes118
Size

10KB
MD5

bf80dbf969b73790253f683cd723fd71
SHA1

418a5bf907a3e9e27378b3792967204c2c5ed738
SHA256

c9a92af5f602834e4ebe133b598beadfd9204fdb863611005aac59d3fb5387c0
SHA512

7b15da530a294a9859cd15377ee491c87057fd701edb4f79a39ab0ac0b340d945e490cec6e24b6fd13bb26ba56e83e2fef50b50924655f996a098eeb6ebd447c
SSDEEP

192:4q6aevaunOdzK+2I/68o5xKo765F2H3NCAEDhOa3ZrtRW:4q6aexAzz/6xxKo7k2XNDYoa3ZZI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bf80dbf969b73790253f683cd723fd71_JaffaCakes118

Files

bf80dbf969b73790253f683cd723fd71_JaffaCakes118
.dll windows:4 windows x86 arch:x86

3b0e36b5a62f86764198d00b51bd7415

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateThread
FreeLibrary
GetTempPathA
Sleep
GetComputerNameA
DeleteFileA
LoadLibraryA
GetModuleFileNameA
GetProcAddress

user32

LoadStringA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

msvcrt

??3@YAXPAX@Z
??2@YAPAXI@Z
strchr
strstr
strrchr
fclose
fflush
fwrite
fopen
ftell
fread
fseek
atoi
malloc
free
strncpy
sprintf
_initterm
_adjust_fdiv
_stricmp

wininet

InternetOpenA
InternetOpenUrlA
InternetCloseHandle

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 988B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 516B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ