3b20c06384b0e240f558dc9cedc0c0d5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3b20c06384b0e240f558dc9cedc0c0d5_JaffaCakes118
Size

8KB
MD5

3b20c06384b0e240f558dc9cedc0c0d5
SHA1

509f7d7cddcf201e144b2c8dfc3626524ba5ca51
SHA256

69791c8ce09100d9d4e570ed7ef570cfa456edcea7935a126c2908d1ec0f3365
SHA512

b0f4c6af060441669ac1fb808e19f8e28b138ea12d6e1edf11c3a550840cfa60e41b18da7efaba3d865f607637cfc9b1ca53c820f7daeab9bd4a461fddc58a09
SSDEEP

192:vC//ZwtdCJIWqYWXNiSilENPxBRHy83k8mu:K+yGWFQYSN3Hy/8m

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b20c06384b0e240f558dc9cedc0c0d5_JaffaCakes118

Files

3b20c06384b0e240f558dc9cedc0c0d5_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f44810b89f2b0652f9a3fc419c1883ee

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

connect
WSAStartup
htons
recv
socket
closesocket
gethostbyname
send

kernel32

DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CloseHandle
CreateThread
CreateFileA
WaitForSingleObject
WriteFile
TerminateThread
GetExitCodeThread
ExitProcess
GetWindowsDirectoryA
GetCommandLineA
Sleep
CopyFileA
GetModuleFileNameA
GetModuleHandleA
WinExec
FreeLibrary
CreateProcessA
GetProcAddress
LoadLibraryA
HeapAlloc
HeapFree
GetProcessHeap

advapi32

RegCloseKey
RegOpenKeyA
RegSetValueExA

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 398B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ