5b4e42584a96b5c37e255f5421be7363_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5b4e42584a96b5c37e255f5421be7363_JaffaCakes118
Size

199KB
MD5

5b4e42584a96b5c37e255f5421be7363
SHA1

d5925c0b8c8e7e54176d56603d626da50d14ab8f
SHA256

9e4575d1bc34681e96bd53d17026499f42beedd18cc3774f9b8a8d3e01081698
SHA512

e83928740d1ba65064de9b1e69ca7ccf196b46433f6887eb9a76b1e586464f3dca7e286a787917dff10691eeb496e1b6ce7c18d5d770b4893ef593a7ce6bb901
SSDEEP

3072:ngvkLohIR2xSCCYdVJJ2Hx6JYZrG7HVheGOig584cGA05JUnA3MojzgZjBSiWT7:nyGo6q37Xp71QGOiX4jLHrgZMb7E

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5b4e42584a96b5c37e255f5421be7363_JaffaCakes118

Files

5b4e42584a96b5c37e255f5421be7363_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2def80e33554c9fa7ba605b5986c9ebe

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

bind
WSAStartup
listen

kernel32

CreatePipe
TerminateProcess
VirtualProtect

gdi32

SetRelAbs
StretchBlt
SetICMMode
ResetDCW
UpdateColors
SaveDC
TextOutW
SetDIBColorTable

shell32

SHAppBarMessage
StrRChrIA
StrStrIA

Sections

.text
Size: 38KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 141KB - Virtual size: 730KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ