c8bea7a3397a198c13c3caf383825121_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c8bea7a3397a198c13c3caf383825121_JaffaCakes118
Size

11KB
MD5

c8bea7a3397a198c13c3caf383825121
SHA1

f2f17ca1f73c6f1347db5bab5fedcec71059a71b
SHA256

c783501e9c87c049742abae27dd9fa9680ffb8a23cfc4b70a3d62ac8d6222b0c
SHA512

2e2feda193379b33a796f289865e67bb7937a89b643cab5189f588ef868eb46d46d452d305c589da4fcdc66292041f4b1962e0d5cb8ae8ac916170eb203b0cad
SSDEEP

192:kWe1ELpDYz639Ii06SzLeQgp3NbePuVC8P6V51sFzdxj1NDh:kWcADdIrdLe5hlge6V5S/jN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c8bea7a3397a198c13c3caf383825121_JaffaCakes118

Files

c8bea7a3397a198c13c3caf383825121_JaffaCakes118
.dll windows:4 windows x86 arch:x86

98cebe92b24c3c3b6e9f219fe36614e0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

EndDialog

kernel32

GetTickCount
HeapAlloc
HeapFree
IsValidCodePage
OpenMutexA
GetProcessHeap
RtlZeroMemory
SleepEx
lstrcatA
lstrcpyA
lstrcpynA
GetModuleHandleA
CloseHandle
GetModuleFileNameA
CreateThread

advapi32

RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegCloseKey

ws2_32

WSAStartup
accept
bind
closesocket
connect
gethostbyname
ioctlsocket
listen
recv
select
send
setsockopt
shutdown
socket

ntdll

RtlExitUserThread

Exports

Exports

trefrmo

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 950B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 626B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ