3ee7a90b5fc3f2b7ba68911e8220df17_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3ee7a90b5fc3f2b7ba68911e8220df17_JaffaCakes118
Size

80KB
MD5

3ee7a90b5fc3f2b7ba68911e8220df17
SHA1

747d7c0c11f5d972e0667fc4d14937256bf11115
SHA256

4eb759fa534ad8a72bbbe1a64509db7264ff3d651ab3eebafe968abc38b69925
SHA512

3eb5567a81ea0c2e56611de6df977e22ebfb0e5017029dd9d2923fa6883f1293bfc6fa58f76ff6efe3060bfe8e6428ce02da8c209a5c501d7725e9210fec36ff
SSDEEP

1536:aa+UrK4y5hy+62dDcwXYJDFIOOWnToIfV:arUrKTy+6oDEJDPOCTBfV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3ee7a90b5fc3f2b7ba68911e8220df17_JaffaCakes118

Files

3ee7a90b5fc3f2b7ba68911e8220df17_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d41f6dec2d6c410b431d12241ca0d99f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAStartup
bind
listen
accept
inet_addr
gethostbyname
htons
connect
closesocket
socket
send
recv

shlwapi

wnsprintfA
StrStrIA
StrStrA

advapi32

CryptDestroyKey
CryptReleaseContext
CryptAcquireContextA
CryptGenKey
CryptExportKey

kernel32

CreateMutexA
CreateThread
ExitThread
FileTimeToSystemTime
GetLastError
CloseHandle
Sleep
ExitProcess
GetTickCount
HeapFree
IsBadWritePtr
TerminateThread
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
GetProcessHeap
lstrlenA
HeapAlloc
HeapReAlloc

Sections

.text
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ