eee13d65efa36e78d09bbcb1d2db58e6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

eee13d65efa36e78d09bbcb1d2db58e6_JaffaCakes118
Size

12KB
MD5

eee13d65efa36e78d09bbcb1d2db58e6
SHA1

dbca7c2978fc96c77ffcef684d930b66bc7d1a18
SHA256

c9e3660818e59af124935f8a0a5d1ed64c336a1c8fc0ce7e5a1edea36607c900
SHA512

37bcf7793c3fed2200269f805551628df26f09fd9f5cc80fbc41ebd37fdba28ea162ebec3ca3ef15b9e959c5e0f1c52190e69583518aa65e3a069e18dbacff6f
SSDEEP

192:vxf8uZqBPEXCSYDMRn0UP9tBPIZ0HjA3JOPPREt00qd+0:vt8HBPYCNDMRn0GBNDeA/h

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eee13d65efa36e78d09bbcb1d2db58e6_JaffaCakes118

Files

eee13d65efa36e78d09bbcb1d2db58e6_JaffaCakes118
.dll windows:5 windows x86 arch:x86

2d67911d17289f2315b7063c5820deaf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileA
GetFileSize
lstrcmpA
HeapAlloc
GlobalAddAtomA
HeapFree
GetProcessHeap
IsBadReadPtr
InitializeCriticalSection
GlobalFindAtomA
LeaveCriticalSection
ReadFile
GetProcAddress
EnterCriticalSection
LoadLibraryA
DeleteCriticalSection
CloseHandle
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlUnwind
IsDebuggerPresent

ws2_32

WSAStartup
gethostbyname
inet_ntoa

Exports

Exports

GetIdCode

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 970B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 908B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ