5b6b5fb4f5296e3efe7ad6a3f543eabe_JaffaCakes118 | Triage

Sharing

General

Target

5b6b5fb4f5296e3efe7ad6a3f543eabe_JaffaCakes118
Size

8KB
MD5

5b6b5fb4f5296e3efe7ad6a3f543eabe
SHA1

76b7a4bc413c05073b69d5250ad257e5ace6cb99
SHA256

86721c5b39948d2dd666edd765dd673a7cfed08915469e16df7b5f19d077e4bd
SHA512

a1bc5ba00eb2ed64626e610f1dd2cdd3b4011eb45277d51be4becd44cf4e53bd18e66f67622c07673bcd7331d2811424a5685e74b24573ec6da704aacf8533ef
SSDEEP

192:fvck8YarPQnLtTCPZy5fCN+yZncZJpRGvUu/p8DZx:fvcXPSTCPM5CNgGvUu/pKZx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5b6b5fb4f5296e3efe7ad6a3f543eabe_JaffaCakes118

Files

5b6b5fb4f5296e3efe7ad6a3f543eabe_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e2f14eac1917776fe474971288981cf1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

connect
WSAStartup
inet_addr
ioctlsocket
WSAGetLastError
htons
recv
socket
select
closesocket
gethostbyname
send

shlwapi

SHSetValueW

kernel32

GetTickCount
Sleep
GetModuleHandleW
CreateThread
LocalFree
CloseHandle
ReleaseMutex
CreateMutexA
lstrcatW
LocalAlloc
GetLastError
lstrlenW
GetModuleFileNameW
GetFileAttributesW
ExitProcess
lstrlenA
CreateProcessW
WaitForSingleObject
CopyFileW

user32

wsprintfW

shell32

SHGetSpecialFolderPathW
ShellExecuteW

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE