2e05b18917e68bac2f1a9d79ea265da9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2e05b18917e68bac2f1a9d79ea265da9_JaffaCakes118
Size

28KB
MD5

2e05b18917e68bac2f1a9d79ea265da9
SHA1

d4af3a128629c5d7b9d97865f904b4c73f059a7a
SHA256

f460c58c71757434d00a44efdb266b75ac876eb37e973c70abd34c100a1a6ef1
SHA512

c9cec5d6dea3884be2a7965d7061b6e88a0631b23047046ce0ee7c24d885820d7bda0bf33672655a9fbff3235a5cf9f7082793d77f7167e7fee57937c9948e46
SSDEEP

384:gxl3kCmdD14WL2poDG4Kbou1hP1GbEaB6E6uBT6JztlXQwes9:gTkRDyWKpoDG4hu1crBXBovves9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2e05b18917e68bac2f1a9d79ea265da9_JaffaCakes118

Files

2e05b18917e68bac2f1a9d79ea265da9_JaffaCakes118
.dll windows:4 windows x86 arch:x86

789302422c9979603eb711fb1bf24c76

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

ntohs
closesocket

msvcrt

malloc
_initterm
_itoa
free
strchr
memcmp
atoi
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
_strlwr
_adjust_fdiv

kernel32

Sleep
CreateThread
lstrlenA
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
lstrcpyA
DeleteFileA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
GetModuleHandleA

Sections

.text
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 926B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 676B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ