049266916891729ebe842decb30bc612_JaffaCakes118 | Triage

Sharing

General

Target

049266916891729ebe842decb30bc612_JaffaCakes118
Size

112KB
MD5

049266916891729ebe842decb30bc612
SHA1

49a7b602a256df0b0a08bc042456ad650935e067
SHA256

1eedf98f7980a53ea6a80f8b030a60801192807309b0fedceabf4778b0b2a7ce
SHA512

3d65969bc8e1ab41b1b912a4912704aae7c57a170663332570e8652d495e27418a2541e5113a7955f6b5048d12152db201a652e1203d037c48ef025ecc1d8cd7
SSDEEP

384:RN5rllP/b7WsCty6cJcqUL8xHw7v9Zh1kVk4eV:RNVldd6cJLUBvJ6Vhc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
049266916891729ebe842decb30bc612_JaffaCakes118

Files

049266916891729ebe842decb30bc612_JaffaCakes118
.dll windows:4 windows x86 arch:x86

747371ef4242992217bd9563831199f1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateThread
ExitThread
GetModuleFileNameA
GetSystemDirectoryA
GetTickCount
LocalAlloc
LocalFree
Sleep
WinExec
lstrcatA
lstrcpyA
lstrlenA

ws2_32

WSACleanup
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyname
gethostname
getsockname
htonl
htons
listen
recv
select
send
shutdown
socket

advapi32

RegCloseKey
RegCreateKeyA
RegEnumValueA
RegOpenKeyExA
RegSetValueExA

Sections

damrai
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ