df6f95afb5941b4a20b415f36015ebcf_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

df6f95afb5941b4a20b415f36015ebcf_JaffaCakes118
Size

28KB
MD5

df6f95afb5941b4a20b415f36015ebcf
SHA1

ad4b8f2846a0b62a83132feb66d9410b233b2786
SHA256

bd91948c66636c2713b968124958bcd02c3a84f5e868df27baa1daa190f87f52
SHA512

6b27d93fc302316d7238b7a01f9db6967988984b50f7a72d15d094d6c72223dc689e7a7b09a3cac885323f0b0851ab75b78509a446efad085c7f92ed7b59df2c
SSDEEP

384:skwEQHQ1TgLL7XMbG2EUZeBWTIPzoD1VM1VWqvmpct5JbG:skG2g7MCWD/M/WVat5BG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df6f95afb5941b4a20b415f36015ebcf_JaffaCakes118

Files

df6f95afb5941b4a20b415f36015ebcf_JaffaCakes118
.dll windows:4 windows x86 arch:x86

7e5db91fe5a80eec3dd93ee5eca6686c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

closesocket
ntohs
ntohl

msvcrt

memcpy
atoi
free
strcmp
malloc
_adjust_fdiv
_strupr
fwrite
time
strrchr
fopen
fseek
ftell
??2@YAPAXI@Z
memset
fread
fclose
strstr
strchr
strncpy
??3@YAXPAX@Z
_strlwr
_itoa
_initterm

kernel32

TerminateProcess
CreateThread
GetModuleHandleA
LoadLibraryA
CopyFileA
GetProcAddress
GetTempPathA
WideCharToMultiByte
lstrcpyA
lstrlenA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
GetModuleFileNameA
Sleep

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 874B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ