1862957a20ea560edcbb974d48ba4b14_JaffaCakes118 | Triage

Sharing

General

Target

1862957a20ea560edcbb974d48ba4b14_JaffaCakes118
Size

16KB
MD5

1862957a20ea560edcbb974d48ba4b14
SHA1

2d21a0e585acc1d148f4c5368c7f03e67b710d48
SHA256

c1ea03ca1f59c7db469863e6e2188eec0e5ee5f3a3dd041cd62642495bab71ec
SHA512

e2fd012745d86e7cad3b7ffd2110e6e38cb87fc2313aafe7f71b20fff3e56b101618cd837292c09868bbbd2263a9f9eb431d8fbfb3f142ea565878d1bed7e12c
SSDEEP

96:nr9kKYy4Yc6OzJ51Q/X/dzs7dXYLPkOkCw6NPPh2JARjOB:nRYy4J6OzJ5avpkdX+cxCw69Qs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1862957a20ea560edcbb974d48ba4b14_JaffaCakes118

Files

1862957a20ea560edcbb974d48ba4b14_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2cad86f8fd4fb54a054163475afd6130

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateThread
ExitProcess
CopyFileA
GetProcessHeap
GetModuleFileNameA
GetModuleHandleA
TerminateThread
HeapAlloc
GetCurrentProcessId
GetTickCount
GetSystemDirectoryA
Sleep

user32

MessageBoxA

advapi32

RegCreateKeyA
RegCloseKey
RegSetValueExA
RegDeleteKeyA

shell32

ShellExecuteA

ws2_32

inet_addr
gethostbyname
sendto
setsockopt
WSASocketA
closesocket
recv
send
connect
htons
socket
WSAStartup

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 772B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE