ffe75986340a8fdba5625abc3218f975_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ffe75986340a8fdba5625abc3218f975_JaffaCakes118
Size

10KB
MD5

ffe75986340a8fdba5625abc3218f975
SHA1

2c98eb893566bd3873f969138e93be07971543a2
SHA256

c187bbc0439b1d68a162dec5aef09994efb6f75ed3116387eb811e02f18b099a
SHA512

74739e8b3c7ead0df11c0fec83350fd981e06c418c7408c612ca7aa17117f55e37dc617b5b7cbba6d06c35ae08b72fec7e83abdf91d9c6a9c3cb7b7efdae9814
SSDEEP

192:S6jp6wCLaEBZbICrSsWXMI8bLBWQ8/l8R:S6jp6wAB1/2hXUPBWB/l8R

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ffe75986340a8fdba5625abc3218f975_JaffaCakes118

Files

ffe75986340a8fdba5625abc3218f975_JaffaCakes118
.dll windows:4 windows x86 arch:x86

c9e4b6b91be530e9a624ad8f26e50401

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CreateThread
Sleep
CreateProcessA
GetSystemDirectoryA
GetVersionExA
CreatePipe
WriteFile
ReadFile
PeekNamedPipe

msvcrt

fread
_close
_filelength
_open
fclose
fwrite
fopen
strncmp
free
_initterm
malloc
_adjust_fdiv
_strlwr

ws2_32

closesocket
connect
inet_addr
htons
setsockopt
socket
WSAStartup
inet_ntoa
gethostbyname
gethostname
send
recv

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 474B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ