0d2ca673ebc32cf0331b7f226e8697d9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0d2ca673ebc32cf0331b7f226e8697d9_JaffaCakes118
Size

8KB
MD5

0d2ca673ebc32cf0331b7f226e8697d9
SHA1

c921d9f5fd02fa84bb73263e07a50762b3a38643
SHA256

87815c005f3ccc46fbb13cbdc717de1a46cc98b9159c22004f1e428d8ef3cfe3
SHA512

c32da11750f8456068b5714b9dcbb76f3b547eb94ca644a8c24a4008101e99a572b3c71186af9d74aab18d208df5ee291f748bd6222a9d5d72e260fc747cdc30
SSDEEP

192:qkF4QpHKM575YF4++5dBBNnkNvwuD8MhwYm/Uoynezf:Q+5MTad0wuopMY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0d2ca673ebc32cf0331b7f226e8697d9_JaffaCakes118

Files

0d2ca673ebc32cf0331b7f226e8697d9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f6db8f2612476a83cb6f06e33a67f45f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
GetModuleHandleA
GetStartupInfoA

user32

DefWindowProcA
PostQuitMessage
RegisterClassExA
UpdateWindow
ShowWindow
CreateWindowExA
SendMessageA
TranslateMessage
DispatchMessageA
GetMessageA

gdi32

GetStockObject

ws2_32

send
recv
closesocket
connect
socket
inet_addr
htons
inet_ntoa
gethostbyname
WSAStartup
select

msvcrt

??2@YAPAXI@Z
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
_endthreadex
fopen
fprintf
fclose
??3@YAXPAX@Z
exit
_beginthreadex
isalpha
sprintf
strncpy
strcspn
strncmp
atoi
_ftime

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 632B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE