edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118 | Triage

Sharing

General

Target

edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118
Size

194KB
MD5

edf8c397adac678ad8b11df86c1abbf9
SHA1

d9fc64ed98a69ac96d9044858d23dc633bb6acc8
SHA256

8e6c5bd07989f54a55be814760bf148a1c49c4e66161c0d00563413832d027b8
SHA512

e1bff306daf491eb923e0fbe2c79e4a031c07be082d37379dfc2a3bb9bd10772a2e6280feb0f195c32764fe84c7a7d3746cae6f898ea9e393ecf03b93fc253e1
SSDEEP

3072:hqUEwVwd0zjld+I/0cmbM+fulMHxznGteKJGJoJuuO73EmjA09+sL:j7VASjlQI/0bfKMTOJ2oMuhPs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118

Files

edf8c397adac678ad8b11df86c1abbf9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2def80e33554c9fa7ba605b5986c9ebe

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

bind
WSAStartup
listen

kernel32

CreatePipe
TerminateProcess
VirtualProtect

gdi32

SetRelAbs
StretchBlt
SetICMMode
ResetDCW
UpdateColors
SaveDC
TextOutW
SetDIBColorTable

shell32

SHAppBarMessage
StrRChrIA
StrStrIA

Sections

.text
Size: 36KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 139KB - Virtual size: 729KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ