852c8bcbf862eef5261b43dfd3ac265c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

852c8bcbf862eef5261b43dfd3ac265c_JaffaCakes118
Size

438KB
MD5

852c8bcbf862eef5261b43dfd3ac265c
SHA1

8646fa78dec6beffc618036bfa67287669366350
SHA256

bc3cd478c0e37dd31468e464ed305c2563fdd5bdb4ab7a2e3af4c6dbe067b19e
SHA512

67b46af322bd9c857504dc5f2ca156d649d3cfa1786d4328a67441f7bb1bbfa212ac489d139fbf7a8a8026bbd36932376428615a55fd7f1f5ad304cb45884f11
SSDEEP

12288:jCz/26dSagAREhSNx2hniuUbUQTbnm/wm58X3pC:QjdSaMhEx4Grbm4y8X3w

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
852c8bcbf862eef5261b43dfd3ac265c_JaffaCakes118

Files

852c8bcbf862eef5261b43dfd3ac265c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8f493e968523bc56741c9c38eb774500

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

DispatchMessageA

advapi32

IsValidSid

ole32

CoCreateInstance

ws2_32

socket

shlwapi

PathFileExistsA

dnsapi

DnsQuery_A

shell32

SHGetSpecialFolderPathA

msvcrt

tolower

oleaut32

SafeArrayDestroy

Sections

.text
Size: 408KB - Virtual size: 696KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE