f860a3bea6b29d8b02c8cf33e9192559_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f860a3bea6b29d8b02c8cf33e9192559_JaffaCakes118
Size

7KB
MD5

f860a3bea6b29d8b02c8cf33e9192559
SHA1

8c961b9e32b7999e6a8eb17c1da12d60c38faad7
SHA256

7e4f02c0ca7f294ec6cf60ac41fb06fa8ece3b78b4fdb3e290fd59438687ee4b
SHA512

df702efbb485a1dec6e896330ec96621a647231f4eef4d6fd3dd4b8cbcf2b76b3e828f293f07fb2b4d3dd9d8119f0244b2da3c9d8bcb2971f41975347fde41d5
SSDEEP

96:IypmMEtZHWMZs4lWSjKswKrwxL/4oidPzI+eMWoKzO+/DoYXU55:Iypm3bHWUDe/Didwbfi+/DzXUH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f860a3bea6b29d8b02c8cf33e9192559_JaffaCakes118

Files

f860a3bea6b29d8b02c8cf33e9192559_JaffaCakes118
.exe windows:1 windows x86 arch:x86

8fc665a607c8ebdbce1dbfb5e126cfbf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
GetCurrentThreadId
GetModuleHandleA
GetProcAddress
GetSystemDirectoryA
LoadLibraryA
OpenMutexA
ReleaseMutex
RtlUnwind
SetCurrentDirectoryA
CreateMutexA
lstrcatA
lstrcpyA
CreateProcessA

advapi32

RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA

ws2_32

inet_addr
htons
socket
connect
WSAStartup

crtdll

_itoa
__GetMainArgs
_sleep
_unlink
atoi
exit
fclose
feof
fgets
fopen
fread
fwrite
memset
raise
rand
signal
srand
strchr
strtok
time

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 744B - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE