eda564fac46137aaedb49314112a83b0_JaffaCakes118 | Triage

Sharing

General

Target

eda564fac46137aaedb49314112a83b0_JaffaCakes118
Size

13KB
MD5

eda564fac46137aaedb49314112a83b0
SHA1

6c435b43fb4624c0112b118a7943e2f4fcd83120
SHA256

9a1a51d84187337750a052cc667a8e463e93d8985565dcab914842be94385cdd
SHA512

8e7476cfce1d82924c32853fb371bacdb15a11e5716d09105dbf3b17de5b80deda1955424a0c8e47d86c775daa39f1fcd2da848a9fba268e88acede2b9989184
SSDEEP

384:I+E0WXYjkh5M3g/IIzgqln6Rou6JxwyAbwhMM//eb:cIwwIztl6BLwhWb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eda564fac46137aaedb49314112a83b0_JaffaCakes118

Files

eda564fac46137aaedb49314112a83b0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

651a44f6b2af3f341a6eee82b8851910

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteFile
CloseHandle
CreateProcessA
CreateFileA
LoadResource
FindResourceA
CopyFileA
LockResource
lstrcmpA
CreateThread
GlobalMemoryStatus
GetSystemTime
GetCurrentProcessId
GetProcAddress
GetModuleHandleA
GetVersion
GetModuleFileNameA
GetSystemDirectoryA
ExpandEnvironmentStringsA
GetVersionExA
lstrlenA
Sleep
GetCurrentProcess
TerminateProcess
ExitProcess

user32

wsprintfA

advapi32

RegCloseKey
RegSetValueExA
RegCreateKeyExA
GetUserNameA
RegCreateKeyA

ws2_32

htons
inet_addr
gethostbyname
socket
inet_ntoa
connect
bind
closesocket
send
htonl
WSAGetLastError
WSAStartup
__WSAFDIsSet
ioctlsocket
select
recv
accept
listen

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ