16415019a86d9972fb2772b3e3d7cd84_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

16415019a86d9972fb2772b3e3d7cd84_JaffaCakes118
Size

29KB
MD5

16415019a86d9972fb2772b3e3d7cd84
SHA1

fcd1b41a68fd20e048a6397c11d7884390226dce
SHA256

7e534ba3bd35339e9ca79b0bf9cd30e165b87695241ea7a98447b89e0a802b65
SHA512

0037083a0adb32a0401a74756fa70314d92c07114dd61988e8cd66db88e8fbf0939c032ca5ae51d42f81fb902d029d3d974dede4502323fc4e93580f4c6cdf57
SSDEEP

384:n4nUOmp1+zbvaQpuADdFseWS4lWOhiXkTiRv:n4nUbwvaZedF4gXkTiRv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16415019a86d9972fb2772b3e3d7cd84_JaffaCakes118

Files

16415019a86d9972fb2772b3e3d7cd84_JaffaCakes118
.exe windows:5 windows x86 arch:x86

0412a4b90fc50a8ff81fc91cfcf0edd7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

snmpapi

SnmpUtilMemAlloc
SnmpUtilMemFree

wsock32

WSAStartup
ioctlsocket
gethostbyname

msvcrt

exit
toupper
__p__pctype
_isctype
__p___mb_cur_max
sprintf
time
fprintf
__p__iob
sscanf
_exit
_XcptFilter
__p___initenv
__getmainargs
_initterm
__setusermatherr
_setmode
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_adjust_fdiv

kernel32

FormatMessageA
GetProcAddress
LoadLibraryA
LocalFree
GetLastError

user32

CharToOemA

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE