40d7652d078da822e6f2d7a21b547448_JaffaCakes118 | Triage

Sharing

General

Target

40d7652d078da822e6f2d7a21b547448_JaffaCakes118
Size

8KB
MD5

40d7652d078da822e6f2d7a21b547448
SHA1

0fa29d9e83ec9bcd0fdc975a77cee4f1f83fdfed
SHA256

8807c8d003b4964eba00b9529d772a87aebf2d8b4bca9e47c984ee1ec93e4d25
SHA512

4f1cb117fe2bc6353b820e81656b52cc701a8564aee6d3f7c90def29c0ece870dff3838a624c843bfcd496b10df599a22d660df611c7620b051b1235bc92c9b0
SSDEEP

192:qdIPKxOKi3cLN3bINuT7OhMhbQJNEiu4dWbZUyJDmRkQAj5Njn:qdIPKxUMNrIcT7OIENZAly1Uln

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/dconnx.exe

Files

40d7652d078da822e6f2d7a21b547448_JaffaCakes118
.zip
dconnx.c
dconnx.exe
.exe windows:4 windows x86 arch:x86

52232454897c2db4153dd91015b3587f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

ExitProcess
SetUnhandledExceptionFilter
Sleep

msvcrt

_strnicmp
__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_errno
_iob
_onexit
_setmode
atexit
atoi
exit
fflush
fgets
fprintf
fwrite
malloc
printf
puts
setbuf
signal
sprintf
strchr
strcmp
strerror
strlen
time

ws2_32

WSAGetLastError
WSAStartup
closesocket
connect
gethostbyname
htons
inet_addr
inet_ntoa
ntohs
recv
send
sendto
socket

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 128B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
winerr.h