20f524a6eb0800bab53f5c24ab90e20b_JaffaCakes118 | Triage

Sharing

General

Target

20f524a6eb0800bab53f5c24ab90e20b_JaffaCakes118
Size

9KB
MD5

20f524a6eb0800bab53f5c24ab90e20b
SHA1

ee5c5caf7e102097bb85f72ad3b1e6e6181906c6
SHA256

7e7e8c83344ba61601d73dc94de47a85394dcf55fe75923fc434a62507ddf09b
SHA512

8ad8402ca949d72bba752d218a425a221cda05db60d767e07392108eb247aa3a5db5e899ef725e79af6b722e22f3f3455c0aacef750da1cd08f3e27e308ad1ac
SSDEEP

192:bQWGpgN5I75bZQ9TNP4oySBKnT4IQfjojU:begN+HQv44gT4IQE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20f524a6eb0800bab53f5c24ab90e20b_JaffaCakes118

Files

20f524a6eb0800bab53f5c24ab90e20b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f52be0081ad2ba4334aebdcb557d70ac

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
OpenProcess
Sleep
VirtualFreeEx
CreateToolhelp32Snapshot
CloseHandle
SuspendThread
SetEvent
WaitForSingleObject
CreateEventA
GetLastError
ResumeThread
CreateThread
Process32Next
Process32First

advapi32

StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus

ws2_32

htons
WSAStartup
inet_addr

msvcrt

__getmainargs
_initterm
__setusermatherr
_except_handler3
_exit
_XcptFilter
exit
__p___initenv
_stricmp
_controlfp
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE