4508bdd632c493c6fbfee3c5f8ec3b87_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4508bdd632c493c6fbfee3c5f8ec3b87_JaffaCakes118
Size

18KB
MD5

4508bdd632c493c6fbfee3c5f8ec3b87
SHA1

1c4b5e185c1bbd5fef515ba6cf9e8381ad6bd435
SHA256

02e3f9b47dec469a41870d7c05b6a208027057fc9a49afb15bdb321a1763ac53
SHA512

e97de47cd77919241145e3bad4092a58fd4b217c8aa3f405ad857aecfa2012bb9ef306ee5b66548954baaa155c94f8935598f195f348d7ec1f9b67735fdeb184
SSDEEP

384:M15cEq6y8UbzHYow3A1hZTuiAtV6elBLyS/:MNqnTbzHYt3A9TduVz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4508bdd632c493c6fbfee3c5f8ec3b87_JaffaCakes118

Files

4508bdd632c493c6fbfee3c5f8ec3b87_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ae2080469dc7a084c2d386b8cda2dd96

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
free
strcpy
sprintf
strncpy
strlen
strstr
atoi
memcpy
localtime
mktime

kernel32

GetModuleHandleA
HeapCreate
HeapDestroy
ExitProcess
GetComputerNameA
HeapFree
HeapAlloc
CreateFileA
ReadFile
CloseHandle
CreateThread
Sleep
GetLocalTime
WriteFile
SetFilePointer
GetFileSize
HeapReAlloc

advapi32

GetUserNameA

wsock32

WSAGetLastError
getsockname
ntohs
closesocket
WSACleanup
WSAStartup
send
htons
sendto
socket
inet_addr
gethostbyname
connect
ioctlsocket
recv
recvfrom
bind
listen
accept

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA

Sections

.code
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 115B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE