e99ccb48c7d1ba1692538963d76836c6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e99ccb48c7d1ba1692538963d76836c6_JaffaCakes118
Size

84KB
MD5

e99ccb48c7d1ba1692538963d76836c6
SHA1

18625b3a1cad10a57a2c0ffef75c925220925678
SHA256

88b1ef09179a11b31784b8162f5280a9bc3066294d11ae9ad333a4ddb1cd6094
SHA512

a091df12d6d5fe2e39abb45ec705aa010aa93ccd2ca2a62b11a4d4a4bb33c5e2a93dc9f271a94761bb7581729105ae08b87cfd09262b627dbf8d3e398a1cc264
SSDEEP

1536:kBn+F+/pvyvJKe5zzN1Kt1RkSs1UfycBjAYn1fpgh:kB+U/pvyvJjtKeXea610

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e99ccb48c7d1ba1692538963d76836c6_JaffaCakes118

Files

e99ccb48c7d1ba1692538963d76836c6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2d07b8a4d02d06c6d33e155dde6c1279

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAStartup
inet_addr
gethostbyaddr
WSAGetLastError
recv
socket
connect
closesocket
send

kernel32

LoadLibraryA
TerminateThread
GetSystemTime
ExitProcess
lstrlenA
MultiByteToWideChar
Sleep
GetProcAddress

advapi32

RegQueryValueExA
RegCreateKeyExA
RegSetValueExA

oleaut32

SysAllocStringLen
SysFreeString

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ