866641f4dfd86a32b18bac019327e948_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

866641f4dfd86a32b18bac019327e948_JaffaCakes118
Size

28KB
MD5

866641f4dfd86a32b18bac019327e948
SHA1

d6bacc525c4ace677281b337e95625170f5f746d
SHA256

5a19eb4140a5871e409a6bad547035622a0f4ff993e3d8daa76cfc25338acda6
SHA512

f0d0b84e2440e6d0b1cfee8f78aee02b7f66b983e25056afc0cd00a7ef95571993e008a67126f778669782d49c74c228090617c839d0ded6fdef95e6917ee5b1
SSDEEP

384:rkiqQP35NqUvw1W7s1xL8T619NsNxRp+qCU/KDjTyBI+kQ6g1/v:r/rJfvwT1xL26lmxRpRCV2hT/v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
866641f4dfd86a32b18bac019327e948_JaffaCakes118

Files

866641f4dfd86a32b18bac019327e948_JaffaCakes118
.exe windows:4 windows x86 arch:x86

52b2dab5e522556d13a62321c8738a42

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
MultiByteToWideChar
lstrlenA
GetStartupInfoA
lstrcatA
ExitProcess
GetModuleFileNameA
GetLastError
lstrcpyA
GetLocalTime
GetProcAddress
LoadLibraryA
FreeLibrary
GetModuleHandleA

user32

wsprintfA

ws2_32

gethostname
WSACleanup
WSAStartup

msvcrt

__dllonexit
_controlfp
_except_handler3
__set_app_type
strncpy
rand
strstr
isspace
__p__fmode
fclose
fprintf
fopen
strncmp
atoi
??3@YAXPAX@Z
strtok
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode

Sections

.text
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 394KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE