3c0210d6ade62a5b92c22c1ebbc99eb6_JaffaCakes118 | Triage

Sharing

General

Target

3c0210d6ade62a5b92c22c1ebbc99eb6_JaffaCakes118
Size

199KB
MD5

3c0210d6ade62a5b92c22c1ebbc99eb6
SHA1

2de0301ebc6e1aaf058f869c35003f56c5c882bc
SHA256

ce71f55b06eb2e531c36000c3c3af1bc5d982aace6c03c6691c4302f76a0b9f1
SHA512

8b45ca1171f78265ee5d0a74c7816c67bdb1f402d4a2eabb4185bf9451188eb8eab148463179581c9a31cb1bb097233835b13cd0e0522b52484143ea49dfef74
SSDEEP

3072:LrJ1anVKKdZtrG69XvXLWkvHQOQpz80F1VVeRRVDgIN7E/6AuexXcFTnkwj1X7Us:HqwYC65vtSVeRjJRbelcFr974

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3c0210d6ade62a5b92c22c1ebbc99eb6_JaffaCakes118

Files

3c0210d6ade62a5b92c22c1ebbc99eb6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2def80e33554c9fa7ba605b5986c9ebe

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

bind
WSAStartup
listen

kernel32

CreatePipe
TerminateProcess
VirtualProtect

gdi32

SetRelAbs
StretchBlt
SetICMMode
ResetDCW
UpdateColors
SaveDC
TextOutW
SetDIBColorTable

shell32

SHAppBarMessage
StrRChrIA
StrStrIA

Sections

.text
Size: 38KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 141KB - Virtual size: 729KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ