d16f7ea43b6d7f3d15e9c3320bf02485_JaffaCakes118 | Triage

Sharing

General

Target

d16f7ea43b6d7f3d15e9c3320bf02485_JaffaCakes118
Size

10KB
MD5

d16f7ea43b6d7f3d15e9c3320bf02485
SHA1

bff82d06d4bc577deff40edfbe348e600dfc19dd
SHA256

b980bfabc7128212f0161f91e8b5cdf01a9411b48c3698c177d307ec74d5247e
SHA512

1162cbe0c0109c96dab5ce0d408e1ddccd2cb32626fdb6a8393081aa755bb95516198e81305adf3418ae8df7f661c015f47e007252d2dbb0ce9a46ce90d87016
SSDEEP

96:tko3qaZ9tzB/8NdmEEHR0Wc5vH6luzPfG4NqnlydUYdl5nHBl/ZhquQ0YCYT60WG:tko3q7dmySlBuqlUdjBBjPYeYGq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d16f7ea43b6d7f3d15e9c3320bf02485_JaffaCakes118

Files

d16f7ea43b6d7f3d15e9c3320bf02485_JaffaCakes118
.dll windows:4 windows x86 arch:x86

5166a378db58ba589a0e6f12d9bcc25c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
ContinueDebugEvent
CreateFileA
CreateRemoteThread
CreateThread
CreateToolhelp32Snapshot
DeleteFileA
GetFileAttributesA
GetModuleHandleA
GetProcAddress
GetQueuedCompletionStatus
GetTickCount
LockFileEx
Module32First
Module32Next
OpenProcess
Process32First
Process32Next
ReadFile
RtlZeroMemory
Sleep
VirtualAllocEx
WriteFile
WriteProcessMemory
lstrcmpiA
lstrcpyA
lstrlenA
GlobalAlloc
GlobalFree
WinExec

ws2_32

WSACleanup
WSAStartup
closesocket
connect
gethostbyname
htons
inet_addr
inet_ntoa
recv
select
send
socket

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ