2e3ab5d25a6863a7ca6276836015a404_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2e3ab5d25a6863a7ca6276836015a404_JaffaCakes118
Size

9KB
MD5

2e3ab5d25a6863a7ca6276836015a404
SHA1

4756dc134c3256b596ea1f1181ba939bd2cc732f
SHA256

c7f1a05b59927672b7a12ca62dcdceb129f0ed1a12241adb961778c8e8739b23
SHA512

5e16fcee0fe7ef00e4279ced77b0df91a3246eac17c05f07d245deb0944c00e3032bf48cb42b054b32989aed3e79deda1ccb14b6811a01d40facc33bb974cf30
SSDEEP

192:Fvck8YarPQnLtTCPZy5fCN+yZKpRGvUDpccMhX:FvcXPSTCPM5CN4GvUDpccO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2e3ab5d25a6863a7ca6276836015a404_JaffaCakes118

Files

2e3ab5d25a6863a7ca6276836015a404_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e2f14eac1917776fe474971288981cf1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

connect
WSAStartup
inet_addr
ioctlsocket
WSAGetLastError
htons
recv
socket
select
closesocket
gethostbyname
send

shlwapi

SHSetValueW

kernel32

GetTickCount
Sleep
GetModuleHandleW
CreateThread
LocalFree
CloseHandle
ReleaseMutex
CreateMutexA
lstrcatW
LocalAlloc
GetLastError
lstrlenW
GetModuleFileNameW
GetFileAttributesW
ExitProcess
lstrlenA
CreateProcessW
WaitForSingleObject
CopyFileW

user32

wsprintfW

shell32

SHGetSpecialFolderPathW
ShellExecuteW

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE