316a123c549ccfdd9bcae293ad836f94_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

316a123c549ccfdd9bcae293ad836f94_JaffaCakes118
Size

49KB
MD5

316a123c549ccfdd9bcae293ad836f94
SHA1

66d15036b1727563708b889da5af41a9e02a6327
SHA256

fb1fbd7b1d5b716e58d7510b69524a11d66ad66ad7ddc75be665a3969864e64f
SHA512

ad458b22e090324db9c77b022ed8dbae3ef0aa4a4f0b6891f34569b12506a5af9944eb5e45185b765319f608ed39f47834c80493f7eada10f9e7c5ba5976b40b
SSDEEP

1536:TJ4hfSZoLFdYJnJvHxCuObkbG22+be1jNm1evui6T:TmJzoXqbkxbSm1emb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
316a123c549ccfdd9bcae293ad836f94_JaffaCakes118

Files

316a123c549ccfdd9bcae293ad836f94_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b531284e47b5c872ac4c2355222d3c82

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreatePipe
TerminateProcess
VirtualProtect

shell32

SHAppBarMessage
StrRChrIA
StrStrIA

gdi32

SetRelAbs
StretchBlt
SetICMMode
ResetDCW
UpdateColors
SaveDC
TextOutW
SetDIBColorTable

wsock32

bind
WSAStartup
listen

Sections

.text
Size: 30KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ