6245b1acfc46c7cfcba56a08082bb378_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6245b1acfc46c7cfcba56a08082bb378_JaffaCakes118
Size

6KB
MD5

6245b1acfc46c7cfcba56a08082bb378
SHA1

153f6c4d2f1de3c9e1cb2700e6ed669255bbf541
SHA256

b2c685e9b1d7ee6745704ea99d5ded241398c3ebc99264548b6283ccb6454666
SHA512

f389a9296c08e20fb590ed33681fa5d2263791436b3847fe10fd28eb8836b3ca14e33ed218412fbb0581e6a69cd88e27f1e264abf7386beb7de0eb4429e9c2b5
SSDEEP

96:ZZhvNRLr7JiH7DmHQJYM01zjpUa2X/P55zftyamftyCMm6+jSpR5MhS/:ZXz7Ji/mOiXUtbfMTfMK6861

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6245b1acfc46c7cfcba56a08082bb378_JaffaCakes118

Files

6245b1acfc46c7cfcba56a08082bb378_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c59734e6702ddc4a83bebd3e506cd9d4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GetSystemDirectoryA
GetVersionExA
GetWindowsDirectoryA
GetModuleHandleA
ExitProcess
CopyFileA
WriteFile
lstrcmpA
lstrcmpiA
lstrcpyA
lstrlenA
CreateThread
CreateFileA
RtlZeroMemory
Sleep
CloseHandle
GetCommandLineA

user32

wsprintfA
ExitWindowsEx

wsock32

inet_addr
listen
ioctlsocket
htons
gethostname
socket
gethostbyname
connect
bind
closesocket
recv
send
WSAStartup
accept

shell32

ShellExecuteA

advapi32

RegDeleteValueA
RegCloseKey
RegSetValueExA
RegOpenKeyExA

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 918B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE