8426136d602a94b239c34325809f88bb_JaffaCakes118 | Triage

Sharing

General

Target

8426136d602a94b239c34325809f88bb_JaffaCakes118
Size

8KB
MD5

8426136d602a94b239c34325809f88bb
SHA1

62bfa9319344874a9ad7fe25d97ebb2031d970c9
SHA256

a43710d807ba93688719fd0e71b96a593176b5ba40509957d3edddd07470f237
SHA512

dcbde07334a424fe5619950001897e9a0ec498c777bc8ec6b5abfc519f546c2892038d4a7547e9e801e6976371c5fe46a1f48001562a3f755eff0c3ffbcc21c2
SSDEEP

192:d+ZP8Ukn14OtRF9XlAqtk0MbQW/reoAoo77ZpIQKucbYo:MP1214OX/lAqKlUarezZySo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/lfscbof.exe

Files

8426136d602a94b239c34325809f88bb_JaffaCakes118
.zip
lfscbof.c
lfscbof.exe
.exe windows:4 windows x86 arch:x86

a60621d4e24c747e1a6577c76288141e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

ExitProcess
GetModuleHandleA
GetProcAddress
SetUnhandledExceptionFilter

msvcrt

__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_errno
_iob
_onexit
_setmode
atexit
atoi
exit
fprintf
fwrite
memcpy
memset
printf
puts
setbuf
signal
strerror
tolower

ws2_32

WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyname
getsockname
htons
inet_addr
inet_ntoa
listen
ntohs
recv
recvfrom
select
send
sendto
setsockopt
socket

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 96B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
winerr.h