68a3aceb097d9a7dd714dc47146570e3_JaffaCakes118 | Triage

Sharing

General

Target

68a3aceb097d9a7dd714dc47146570e3_JaffaCakes118
Size

16KB
MD5

68a3aceb097d9a7dd714dc47146570e3
SHA1

aa5686f2b812b76ad3aca5f3a0f9bfd24bfa4c80
SHA256

0a15cc4d4b04383d325243fe3889364dba03d8bf3ec7b77b18ecce0646586ddf
SHA512

2d4ff68bdcf1d8d6019fcff9401c103d04f5aa00a937075d961cad7aa5a4ed77e2eb5f65981db6fdf1e36a558e8d8010d9d65079947071110aed91695c690b1c
SSDEEP

96:nrUKYy4Yc6OzJZ1Q/Xvdzc5BhcjMq4LDkqkCZ7eCPPh2JARjOB:nUy4J6OzJZavZ+XUMqeQNCZ64Qs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
68a3aceb097d9a7dd714dc47146570e3_JaffaCakes118

Files

68a3aceb097d9a7dd714dc47146570e3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7d3e33ed22e5a1299a57849e9a48c865

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateThread
ExitProcess
TerminateThread
GetProcessHeap
GetSystemDirectoryA
GetModuleFileNameA
GetModuleHandleA
HeapAlloc
GetCurrentProcessId
GetTickCount
CopyFileA
Sleep

user32

MessageBoxA

advapi32

RegCreateKeyA
RegCloseKey
RegSetValueExA
RegDeleteKeyA

shell32

ShellExecuteA

ws2_32

inet_addr
gethostbyname
sendto
setsockopt
WSASocketA
closesocket
recv
send
connect
htons
socket
WSAStartup

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 772B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE