f0e9862f9d7305c270141fb8d707fbc9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f0e9862f9d7305c270141fb8d707fbc9_JaffaCakes118
Size

199KB
MD5

f0e9862f9d7305c270141fb8d707fbc9
SHA1

56e8542b7756acde9e6e393b5abf6c3594682d2a
SHA256

929be8b7e0dfcae1da461ef8690dc4f1fa7dbafc822fa71a55995b4c675753e7
SHA512

47e1e991d668b31a55f87679dba95e295aca2867e0848a7a1d3f1cf0d4a8c68ffe53ebf716f0e64b4a16fd6b95230ef19833c0f1bad813a94bd6a44bb8e649a1
SSDEEP

6144:i9lUi5iGtL4khAy8YmlNOFpzmk75GlJnIil:icEL4wz87l8FJjYFl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f0e9862f9d7305c270141fb8d707fbc9_JaffaCakes118

Files

f0e9862f9d7305c270141fb8d707fbc9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2def80e33554c9fa7ba605b5986c9ebe

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

bind
WSAStartup
listen

kernel32

CreatePipe
TerminateProcess
VirtualProtect

gdi32

SetRelAbs
StretchBlt
SetICMMode
ResetDCW
UpdateColors
SaveDC
TextOutW
SetDIBColorTable

shell32

SHAppBarMessage
StrRChrIA
StrStrIA

Sections

.text
Size: 38KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 141KB - Virtual size: 729KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ