nloader | f2ba03482cd57eef76f80554374f8a5c_JaffaCakes118 | Triage

Sharing

General

Target

f2ba03482cd57eef76f80554374f8a5c_JaffaCakes118
Size

6KB
MD5

f2ba03482cd57eef76f80554374f8a5c
SHA1

417560cea970e841fa0d83db73f2e894fa4d261c
SHA256

c62217c3d731798ffd5eeabf66cd214ba2ab7ebc1d4074ebc757928623deb18c
SHA512

925a08250e459adbcdf7e4753bfcae44ee03be04f3d6da698e2c3c18f6777dafa5229307f1fb7acf2428576c36ac64fbba2a9e7686f8e3822219ad0932eaa974
SSDEEP

96:L827cSdUP5cDDkvUBI08yc8yoiqmnnKgnmSq/h6h/7aS9Vxco/m:LT7cuQcDD7fhi3O5/h6FaIV1

Score

10^/10

nloader

Malware Config

Signatures

Nloader family
nloader

Nloader payload 1 IoCs

resource	yara_rule
sample	nloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f2ba03482cd57eef76f80554374f8a5c_JaffaCakes118

Files

f2ba03482cd57eef76f80554374f8a5c_JaffaCakes118
.dll windows:6 windows x86 arch:x86

213f3a37dd98f37379105d390f7e35e0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileA
WriteFile
CloseHandle
Sleep
GetProcAddress
LoadLibraryA
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent

ws2_32

WSACleanup
WSAStartup
send
gethostbyname
recv
htons
connect
closesocket
socket

user32

wsprintfA

Exports

Exports

DF1

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ