1c6ad08d702258d1cd2c08829f6eba47_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1c6ad08d702258d1cd2c08829f6eba47_JaffaCakes118
Size

79KB
MD5

1c6ad08d702258d1cd2c08829f6eba47
SHA1

a3cf38c44a927bf35a5aaaa1580ec7a13a6986db
SHA256

72735ce156f3b7d854e9379b5a9ac53a5038b50cbaba8d6ba665f22971395a44
SHA512

2c1e1ec29415fd0cb3e574b08ba5ea41060bd9cc848e2232a672dc96a00c04194699878ca3ce440eed3d59ef053a73372ad742c0993d35a179f987b7a4c82d98
SSDEEP

1536:g5+9HrBru+F7Ff8wqZMqtLMCAszjgGKN31ClvntqOhruom7NgHUT8c60psF:g5+9LBrnFvqZMqFkulqUuojiI0pi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1c6ad08d702258d1cd2c08829f6eba47_JaffaCakes118

Files

1c6ad08d702258d1cd2c08829f6eba47_JaffaCakes118
.exe windows:0 windows x86 arch:x86

b44e66c14fe79eeb6e152613f0851c03

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSASocketA

kernel32

FreeLibrary
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

ExitWindowsEx
MessageBoxA

advapi32

RegOpenKeyExA

shlwapi

SHDeleteKeyA

msvcrt

_ui64toa

shell32

ShellExecuteA

Sections

.text
Size: - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

0
Size: - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

1
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ