e2b8bbc9df437f18b9e03580cb056854_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e2b8bbc9df437f18b9e03580cb056854_JaffaCakes118
Size

43KB
MD5

e2b8bbc9df437f18b9e03580cb056854
SHA1

e04dada1bff968f6f069eeb3e058a8a895a0dcec
SHA256

d30df80a0c1d9dd4550eb2860eb7efc655aa16d414309aa863a8ac545fb3497e
SHA512

4fdee8e57c1fc8803c841217eb02ff9c1ed08650c0830203a9dd67448f805eadd97f0c864bd03b3f6316085425b0dd3976a2f35fee7fe7819b28f192d4c8ea8f
SSDEEP

768:i3b5P0QDyeXVRskG4IwL9H7d9qzWZQoTV6Ony1Uo1rY4rml0lNjoEjTfTP0D:sbtBXXVRMKL97iSpTkOEj1rY4Kl0lqEY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e2b8bbc9df437f18b9e03580cb056854_JaffaCakes118

Files

e2b8bbc9df437f18b9e03580cb056854_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6efdf60df3e294438a907f9bdf3f9442

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CopyFileA
CreateFileA
CreateThread
DeviceIoControl
ExitProcess
GetCurrentDirectoryA
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetProcAddress
GetTickCount
GetVersionExA
IsDebuggerPresent
ReadFile
Sleep
VirtualAlloc
VirtualFree
VirtualProtect
WriteFile

wsock32

gethostbyname
WSAStartup
WSACleanup

user32

MessageBoxA

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 778B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE