de74b105b0ff828dec8675f0b0c8ddc3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

de74b105b0ff828dec8675f0b0c8ddc3_JaffaCakes118
Size

24KB
MD5

de74b105b0ff828dec8675f0b0c8ddc3
SHA1

f5227e31b1fbbcfb8ce6661800d5045357b7502d
SHA256

9a44b8434bf4cdee70bcf00641d8462aae7515edf9f0e95f538007093e7fcb75
SHA512

5f4d06958504d20378b0e688e283d9efe85c2a073e11a08e8cc28f6472eed98a97373b40b30930c7add17d28d789577c320fae74251420ba1ce46b85c175b517
SSDEEP

192:T54LpC1qdAKpAWyx2G0f/vktHJhn4R8Y18l+RZIjQC8zpct5U11ei:TEOqNAWo0vkdJhnJYMF8zpct5Ooi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
de74b105b0ff828dec8675f0b0c8ddc3_JaffaCakes118

Files

de74b105b0ff828dec8675f0b0c8ddc3_JaffaCakes118
.dll windows:4 windows x86 arch:x86

dd889e89591425fcf8aa80e627e466aa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

ntohs
closesocket

msvcrt

malloc
_initterm
_itoa
free
strchr
atoi
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
_strlwr
_adjust_fdiv

kernel32

Sleep
GetModuleHandleA
lstrlenA
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
CreateThread

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 886B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 658B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ