3f8cac75d9ebf21fb48ded6f0b39ce6d_JaffaCakes118 | Triage

Sharing

General

Target

3f8cac75d9ebf21fb48ded6f0b39ce6d_JaffaCakes118
Size

136KB
MD5

3f8cac75d9ebf21fb48ded6f0b39ce6d
SHA1

884b1bdc937eac63b4c0e5be7e638233357692fb
SHA256

f43e1bd702878fd108209b7813064389021dcbfba5f0a1d071bb45ef17293e11
SHA512

37cd652d45a779e4dd288e498cbc63284673454b832321e4765a11854abc09da50f140a40242a043c511cbc9e6fd5733d0ba86655462f8246a73562b40d85a65
SSDEEP

3072:4weeXkkJZfxUywZ1U5n0iEmc85ddqac0j8fNcSK:FMkJZiZG5n0iEmNYa1j8VD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3f8cac75d9ebf21fb48ded6f0b39ce6d_JaffaCakes118

Files

3f8cac75d9ebf21fb48ded6f0b39ce6d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a78238e69deaff988e4540a88a53345e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAStartup
gethostbyname
socket
bind
htons
connect
closesocket
WSACleanup

kernel32

GetProcAddress
GetStartupInfoA
GetSystemDirectoryA
GetTempPathA
FindResourceA
SizeofResource
LoadResource
LockResource
GetCurrentProcess
GetModuleHandleA

msvcrt

__set_app_type
_except_handler3
_controlfp
time
__p__fmode
sprintf
free
malloc
_strlwr
fclose
fwrite
fopen
fprintf
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 120KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ