4c200972cc0bb744f0bc261eb99fc906_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4c200972cc0bb744f0bc261eb99fc906_JaffaCakes118
Size

9KB
MD5

4c200972cc0bb744f0bc261eb99fc906
SHA1

1c529d706b66a344713da62307bd37bb9a4d4605
SHA256

54e58e6b2a817a84be59721a726c7ccad9706c5a196e7e90c84ec85eb0a36de3
SHA512

af09c987d651b286031e6cfad04b203b5fc34c47ef0d750a97b4923bd4831670e84e38a8fe0fedcf14f7814f4cf9f21bc65f6448ac476092364498f9abe139af
SSDEEP

192:mZOwRscL5t5dWp8Y7Qj/3oGMMPRvZSP2yfGCkQ:mZ9LHqA3o7YRgTGCJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c200972cc0bb744f0bc261eb99fc906_JaffaCakes118

Files

4c200972cc0bb744f0bc261eb99fc906_JaffaCakes118
.exe windows:6 windows x86 arch:x86

7ee5c6bdd023943a161d8348fd7d9a17

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\programs\mutantofthefuture\sloader\objfre_wxp_x86\i386\SLoader.pdb

Imports

advapi32

RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegCloseKey

kernel32

HeapAlloc
GetProcessHeap
HeapFree
QueryPerformanceCounter
CloseHandle
DeviceIoControl
CreateFileA
CreateProcessA
WriteFile
GetTempFileNameA
GetTempPathA
ResumeThread
SetThreadContext
WriteProcessMemory
VirtualAllocEx
ReadProcessMemory
GetThreadContext
lstrcatA
GetEnvironmentVariableA
WaitForSingleObject
Sleep
ExitProcess
GetShortPathNameA
lstrlenA
lstrcpyA
GetCommandLineA

wsock32

closesocket
recv
send
connect
htons
socket
WSACleanup
WSAStartup

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 356B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 332B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ