328305c0c834ab1ba3483f6c2f2cf295_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

328305c0c834ab1ba3483f6c2f2cf295_JaffaCakes118
Size

58KB
MD5

328305c0c834ab1ba3483f6c2f2cf295
SHA1

fdab6478d568c5e7da5466dded26cbe5c8fc0dcf
SHA256

9a2cdef8ef218d418e4ff41360e79f6156331c1eff40b352c0b1aa50cc3c8244
SHA512

43d7d575fcde615b6ead99efb67b65e5dec62ed296160adb6327b1fda190e4f3577bef2d338990e4b7c8410580cd9d898c85d68d772b8fcff28bd14faaa3b2e8
SSDEEP

768:Gj9P4RIHxCrTTVeIJjNYNw72Lp98jI4iEyeUqWTThlbiP1UKh+SIL6:GxP4RIH8nTaaCV9TRVqW/Ge/SL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
328305c0c834ab1ba3483f6c2f2cf295_JaffaCakes118

Files

328305c0c834ab1ba3483f6c2f2cf295_JaffaCakes118
.exe windows:1 windows x86 arch:x86

f09323a336ecfbc457ac143da91276fb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RtlUnwind

user32

MessageBoxA

ws2_32

WSACleanup
inet_addr
htons
socket
gethostbyname
connect
closesocket
WSAStartup
send
recv

crtdll

_fileno
_iob
_itoa
__GetMainArgs
_setmode
_sleep
_stat
_strnicmp
abort
exit
fclose
fopen
fputc
fread
fwrite
localeconv
memcpy
memmove
memset
pow
raise
signal
strcat
strchr
strncmp
strtol
wcslen
wctomb

Sections

.text
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 608B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 88B - Virtual size: 88B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE