06ee90b023f760817107134a70ea8c8a_JaffaCakes118 | Triage

Sharing

General

Target

06ee90b023f760817107134a70ea8c8a_JaffaCakes118
Size

108KB
MD5

06ee90b023f760817107134a70ea8c8a
SHA1

dc957419e87f0c54433342847ce25cda7b57536a
SHA256

f5866503e7a8e3d0975d6b0875bed97ca38cefb2b3e0fcb7946596fe89b949d8
SHA512

bfae65f1c57ef765ec711085ba3901f05e0e825c5077dcbef75caa64ed6c3c3692f289e9b7525855175fc095ce55b6d7e2c4334d185799116b88caa6af9122bc
SSDEEP

3072:kPYXHOXck48SBwQgnSxld2q8ZzXt7OuBBWKGE9j:kQk4VSnqlOzd71TWKGEV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
06ee90b023f760817107134a70ea8c8a_JaffaCakes118

Files

06ee90b023f760817107134a70ea8c8a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f924dc8682324323f83ff549d3fd4413

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
CloseHandle
GetModuleHandleA
GetProcAddress
LoadLibraryA
CreateThread
WinExec
Process32Next
TerminateProcess
GetCurrentProcessId
OpenProcess
Process32First
CreateToolhelp32Snapshot
GetStartupInfoA

ws2_32

WSACleanup
inet_addr
connect
htons
closesocket
recv
send
gethostbyname
WSAStartup
socket

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_stricmp
srand
time
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 956B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 616B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ