e7b6bf263f494fa34270bf2a709b085d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e7b6bf263f494fa34270bf2a709b085d_JaffaCakes118
Size

16KB
MD5

e7b6bf263f494fa34270bf2a709b085d
SHA1

74c4701eb651536bede26f45ec5acb70c4c0eada
SHA256

a2389269b31f0448a23feee04d269ccf756279e586a26e0ecffd75ba85bbf143
SHA512

b5de77d590cb042e8f91ef639709cc95c8a4a072a777329706ca7529801a21739bd13a6640cae0c23a02188eebbe8bacead8e09cb0b9a81059eb32b2ed3df811
SSDEEP

384:/Ga16r+LZ+KQlHeh4/Qk8OzVRwdAyeVhQEhKOG5IBuPWJoKw:ea16rc4rlHo4Yk8On105WI0o/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e7b6bf263f494fa34270bf2a709b085d_JaffaCakes118

Files

e7b6bf263f494fa34270bf2a709b085d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6cdbf3ad05b105f3d62b0eff8df81fb7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

listen
accept
bind
inet_addr
WSAGetLastError
WSAStartup
gethostbyname
socket
setsockopt
htons
inet_ntoa
connect
select
__WSAFDIsSet
send
closesocket
recv
shutdown

kernel32

GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSection
GetCurrentProcessId
CreateThread
GetCommandLineA
CreateMutexA
GetLastError
Sleep
GetTickCount

advapi32

RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey

msvcrt

realloc
atoi
strchr
strstr
_time64
_fullpath
free
sscanf
strncpy
rand
srand
strtok
malloc
strrchr
sprintf
exit
_spawnl
fwrite
fclose
fread
_filelength
fopen
_snprintf
_open
gmtime
strncmp
isdigit

Exports

Exports

time

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE