633293d14221dcb9466108b4290037a2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

633293d14221dcb9466108b4290037a2_JaffaCakes118
Size

13KB
MD5

633293d14221dcb9466108b4290037a2
SHA1

89b7d6c62cf33a8fbb817e3b5ad623526c123570
SHA256

668314da7f8e45d1890d83198e9b7efb611d599b2153289284aa14038e511e16
SHA512

071dbc685d28d29eedf0bf74135c2c8452d04909b09c247d077b8bb1b385f9fdb53bbf18a239c7736fc3bb0f5046c8c36a0b3a8006201e1996aa45e70aced6f7
SSDEEP

192:zjK5vbxbyUPN7zDbspMdxGvwdroRoLocRkQAWHS/qY+TC4bngbX43+P/8/y1meh:XKBbZ17n4E5eoLV1ffLgbX43+PU/yh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/rd2fp.exe

Files

633293d14221dcb9466108b4290037a2_JaffaCakes118
.zip
rd2fp.c
rd2fp.exe
.exe windows:4 windows x86 arch:x86

05b3749de465f3a2a369453e7ad151ad

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

ExitProcess
SetUnhandledExceptionFilter
Sleep

msvcrt

__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_errno
_iob
_onexit
_setmode
atexit
atoi
exit
fgets
fprintf
fputc
fwrite
memcpy
memset
printf
puts
setbuf
signal
strchr
strerror
strlen
time

ws2_32

WSAGetLastError
WSAStartup
bind
closesocket
gethostbyname
htons
inet_addr
inet_ntoa
recvfrom
select
sendto
socket

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 128B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
rdcksum.c
rdcksum.h
winerr.h