2eca5315168c662221049dea75c209ae_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2eca5315168c662221049dea75c209ae_JaffaCakes118
Size

15KB
MD5

2eca5315168c662221049dea75c209ae
SHA1

c9dc73e16a6ab7b169371efb7a46aa33de390976
SHA256

6231cd8991dd7e56507ff8a829507206ff0a32c7a14c7f35ccfde8f5882fc7c8
SHA512

0ec4139cf8abcf2d2b0159dc11faca619d858bce32dda0ac78dd48b9e1abfaddb2864e6dc6227a98ede1b832c08b81adbf1c71dc085141c85f8fcdf272307fa2
SSDEEP

384:NGPTx+o72gjbhnPcizWE8vbllmHi1JNL:NG9+oCghnPfOzL1JNL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2eca5315168c662221049dea75c209ae_JaffaCakes118

Files

2eca5315168c662221049dea75c209ae_JaffaCakes118
.dll windows:4 windows x86 arch:x86

b425dd4ecae14c252c70a58e22d61db7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
GetLastError
GetTickCount
VirtualAlloc
VirtualFree
GetVersionExA
CloseHandle
CreateThread
ReadProcessMemory
GetCurrentProcess
ExitProcess
WriteProcessMemory
VirtualProtectEx
GetProcAddress
GetModuleHandleA
GetModuleFileNameA

user32

CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
wsprintfA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

ws2_32

shutdown
closesocket
inet_ntoa
gethostbyname
select
connect
inet_addr
htons
ioctlsocket
socket
send
recv
__WSAFDIsSet
WSACleanup
WSAStartup
gethostname

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.zdata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 652B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ