d70d11f0243e2c9f3c1a382f54fad5b2_JaffaCakes118 | Triage

Sharing

General

Target

d70d11f0243e2c9f3c1a382f54fad5b2_JaffaCakes118
Size

47KB
MD5

d70d11f0243e2c9f3c1a382f54fad5b2
SHA1

eee27707a242daabd6fea035aebbd84066931f12
SHA256

90230635abbc6a862b5c7d5bf6ecb876c630142d4b9c939e0d01e8d3634cb84a
SHA512

7da5abb2aa22d00ab34699d2cf309620b7545c8590bc609ed006d3e1cb593a9b8c7dfa4dee80267213f6639a9901ef93e64a75e2a0f32e63b39d14a0b2388cc5
SSDEEP

768:zP1Ebuu+QXXZ0ulODr2+JfHWGCOgURqkWxRKi6sEjzGo7tW+RW2MJ2XNwQO+iEWW:zp0XXijDrJhHWGCO5qkWxRKi6sZw9pOK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d70d11f0243e2c9f3c1a382f54fad5b2_JaffaCakes118

Files

d70d11f0243e2c9f3c1a382f54fad5b2_JaffaCakes118
.dll windows:4 windows x86 arch:x86

5027c71538662ee5cd75a70a8f29516f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdump

ntprintf

r1fns

r1lodcrt

librfc32

ItAppLine
RfcCallReceive
RfcLastErrorEx
RfcClose
ItCreate
RfcOpenEx
ItDelete
ItCpyLine
ItLeng
ItGetLine
ItFree
ItFill

msvcrt

_isctype
sprintf
strncmp
strlen
_pctype
realloc
__mb_cur_max
free
calloc
memcpy
strcpy
strncpy
memset
malloc
strcat
_adjust_fdiv
atoi
strtol
_initterm

kernel32

DisableThreadLibraryCalls

Exports

Exports

sappas

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 676B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ