0f3ab2fa1f74b737f3bd27f9172f835b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0f3ab2fa1f74b737f3bd27f9172f835b_JaffaCakes118
Size

10KB
MD5

0f3ab2fa1f74b737f3bd27f9172f835b
SHA1

f0f26d398edb2fe325e1599091026e29f509ad58
SHA256

cce7d2197b23d361ce71be8e982be2bb051c4f2b6ecac390f201ec1f4c3185ca
SHA512

2d2491de16e6bd39548058dacdfc575feb00c0f4a325c844604c73c46a2629d23046d93acaafc66284241a2bdb70068fce2aa036472322bb97fb2176b56e0b51
SSDEEP

192:MQFJoRcfbSphwu24Rwr1qeqgOIOZQxlmqIzsLESdaUL8YTa4:Tephwn4R1IOZQxk5ooS1L8S

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f3ab2fa1f74b737f3bd27f9172f835b_JaffaCakes118

Files

0f3ab2fa1f74b737f3bd27f9172f835b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

24ab379ba31a738683f53246099b4e85

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

WSAGetLastError
closesocket
WSAStartup
send
recv
ioctlsocket
socket
htons
connect
gethostbyname

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

user32

MessageBoxA

kernel32

GetExitCodeProcess
WriteFile
CloseHandle
CreateProcessA
GetStartupInfoA
GetModuleHandleA
WaitForSingleObject
GetProcessHeap
HeapFree
HeapAlloc
lstrcmpA
lstrcpynA
lstrlenA
CreateDirectoryA
GetFileAttributesA
lstrcatA
lstrcpyA
GetTempPathA
GetCommandLineA
GetModuleFileNameA
SetFilePointer
ExitProcess
Sleep
CreateFileA
GetTickCount
ReadFile
lstrcmpiA
SetEvent
CreateEventA
CreateThread
WaitForMultipleObjects

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE