19a010f428f12e116fc08280e05f6de8_JaffaCakes118 | Triage

Sharing

General

Target

19a010f428f12e116fc08280e05f6de8_JaffaCakes118
Size

25KB
MD5

19a010f428f12e116fc08280e05f6de8
SHA1

72f226cb95e7c0ba2cbf927b6ded51f8d5ab501e
SHA256

cb911c092748e465a4e3f19698958cb7e663e7bbc9d2863b66fe17fe4360a6fc
SHA512

d915a545537a245bf42e70567b31ac5c77849342ae3f7205d7e69b8f614976e7a20f829a2eb4567d372575b0a0d824dfa5bb932301b1c6251c5168ccf8c1620d
SSDEEP

192:QUHLM71TJZimBXIrEE20wlqlFdV6k6LtM8LZeDP8IZE2ddxxo57yzvgX0sVjvqAC:y7j5GndEk62PLEOy5GbgXPVrfC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
19a010f428f12e116fc08280e05f6de8_JaffaCakes118

Files

19a010f428f12e116fc08280e05f6de8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

58731c7a67c9ecfe83b23387245b0abb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCreateKeyExA
RegSetValueExA

kernel32

AddAtomA
ExitProcess
FindAtomA
GetAtomNameA
GetCommandLineA
GetModuleHandleA
GetStartupInfoA
OutputDebugStringA
SetUnhandledExceptionFilter
Sleep

msvcrt

__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_iob
_onexit
_setmode
abort
atexit
fflush
fprintf
free
malloc
memcpy
rand
signal
sprintf
srand
strcmp
strcpy
strlen
strtok
time

shell32

ShellExecuteA

ws2_32

WSAStartup
connect
htons
inet_addr
recv
send
socket

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 224B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE