73a837053ecafa0798b3acd01a3169a0_JaffaCakes118 | Triage

Sharing

General

Target

73a837053ecafa0798b3acd01a3169a0_JaffaCakes118
Size

13KB
MD5

73a837053ecafa0798b3acd01a3169a0
SHA1

a825d499814a19eb98be51535d62705e31d10aef
SHA256

1c0f6f61dda3a782a548f024a1fa32b5ecf8f5e3bb71de9994dc6e74ef8b4d45
SHA512

20569988b8e972ca81b60132fa4092a227a1516f31a9eed63e70094047cdafc2338a687dd998dddabafd5cd82f5524d80a4d0538b56016ea0499c5b8722f2638
SSDEEP

192:39drIunMLgDP+m0UcXx+Mk7ubPcYWdUWIw/zfAL9uxqNuxq:3XQm0P+w7cYWdUWIJLkz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
73a837053ecafa0798b3acd01a3169a0_JaffaCakes118

Files

73a837053ecafa0798b3acd01a3169a0_JaffaCakes118
.exe windows:5 windows x86 arch:x86

192551b117d932b62f2e666b68f95086

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

malloc
_write
_iob
fprintf
_except_handler3
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__initenv
_cexit
_XcptFilter
_exit
_c_exit
strrchr
_close
_open
exit

kernel32

CloseHandle
TerminateThread
LocalFree
GetCurrentThreadId
ExitThread
Sleep
GetOverlappedResult
GetModuleHandleA
GetLastError
WriteFile
ReadFile
GetStdHandle
CreateEventA
CreateThread
FormatMessageA

ws2_32

shutdown
getservbyname
WSAStartup
select
__WSAFDIsSet
recv
closesocket
setsockopt

advapi32

GetUserNameA

user32

CharToOemBuffA

mswsock

rcmd
rexec
s_perror

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ