26289d3f0be400d6df996b221f81912c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

26289d3f0be400d6df996b221f81912c_JaffaCakes118
Size

6KB
MD5

26289d3f0be400d6df996b221f81912c
SHA1

9ee948c31f43544e9f81591ce0b780d762a42961
SHA256

56198d417aa60bfe19ed05b3d1f89383ac9124222bfb994c2a16c12fe2faa7f9
SHA512

144e66741de2d6c0067364edfe2b5d0803d2d04bd6559b91c39e5a7f117c602de58445c38437efefe33988f9215fb118bb346e9af3e554c92f04293d64ed13b2
SSDEEP

48:Kv7/rH7Mh33HX7xy5Ztql3kDrCFg9LpsrWpqCIn/IG0wQm64g7bS+UQ6vBmif0qr:mTIh33XMikDrCFg9lACcNxIiMQN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
26289d3f0be400d6df996b221f81912c_JaffaCakes118

Files

26289d3f0be400d6df996b221f81912c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5375927ecaf4428fa4a77c445a77f106

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfA

kernel32

GetPrivateProfileStringA
GetProcAddress
GetWindowsDirectoryA
LoadLibraryA
GetPrivateProfileSectionNamesA
LocalFree
Sleep
WideCharToMultiByte
lstrcatA
lstrcmpiA
lstrlenA
FreeLibrary
ExitProcess
LocalAlloc

wsock32

recv
socket
connect
closesocket
WSAStartup
gethostname
send

advapi32

RegCloseKey
RegCreateKeyA
RegQueryValueExA
RegSetValueExA

ole32

CoTaskMemFree

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE