fe3fac6a40b7756d56ab11ff1fb0ad6a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fe3fac6a40b7756d56ab11ff1fb0ad6a_JaffaCakes118
Size

32KB
MD5

fe3fac6a40b7756d56ab11ff1fb0ad6a
SHA1

c33e4f16b91cf8e59e2da859cd5d8c1b70539b58
SHA256

90facea522703fc337ad1090fded9d2c8bc5d7f28d10aa1253ecf251e8c7f819
SHA512

2435a76b767432a8a0373bddcb8b428305311367048a6dc43ef85b5d2d07fe896891b7733e49340b3a76bf4af69df7d17bbd4afe764e9e0e008c61880db14f41
SSDEEP

384:BXT4hn7B6ZiybjRwc0QmINoObud+U0m7//cQoY:BT4d7B6ZiybIQC0m7//hoY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fe3fac6a40b7756d56ab11ff1fb0ad6a_JaffaCakes118

Files

fe3fac6a40b7756d56ab11ff1fb0ad6a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a64a98c1be413e33c0cbc95324f72d02

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
GetProcAddress
LoadLibraryA
GetTickCount
GetCurrentProcessId
CreateThread
MoveFileA
DeleteFileA
GetModuleFileNameA
CopyFileA

user32

wsprintfA

ws2_32

socket
send
__WSAFDIsSet
select
recv
connect
gethostname
WSAStartup
WSAGetLastError
setsockopt
htons
htonl
sendto
closesocket
WSACleanup
inet_addr
gethostbyname
inet_ntoa

iphlpapi

GetIfTable

msvcrt

strstr
??2@YAPAXI@Z
_local_unwind2
_except_handler3
_iob
fprintf
printf
rand
sprintf

Sections

.text
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ