1a17317b22fd813f9895b3ce079abd70_JaffaCakes118 | Triage

Sharing

General

Target

1a17317b22fd813f9895b3ce079abd70_JaffaCakes118
Size

36KB
MD5

1a17317b22fd813f9895b3ce079abd70
SHA1

f7c5565b81f212164c46860bc7117e5556cf1e5f
SHA256

c89a8d8272894b2f1986aab42a5b81305e5d0ea535e7d47f93da783f9f1f19db
SHA512

2d9e78288d399de4a5b243d238d2b7d74130a890188020ec71dff7999676fbb50ed21e8b073ab0946f053ab134c123c2b0da65c148b2a29675913261404e9341
SSDEEP

768:EXxR5CS2fGiDq+x9YP3f4n2rtQ/Qj7U1PhzIuE:EXxqS2MMU3gJQc1h

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a17317b22fd813f9895b3ce079abd70_JaffaCakes118

Files

1a17317b22fd813f9895b3ce079abd70_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cf1483149c3c835f4f12cacd0a436e14

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadFile
ContinueDebugEvent
CreateFileA
CreateThread
ExitProcess
GetCurrentDirectoryA
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetProcAddress
GetThreadContext
GetTickCount
IsDebuggerPresent
CloseHandle
SetThreadContext
Sleep
VirtualAlloc
VirtualFree
VirtualProtect
WaitForDebugEvent
WriteFile

wsock32

gethostbyname
WSAStartup
WSACleanup

user32

MessageBoxA

Sections

.text
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 822B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE