8da12cbfa5eec23eb72f2dec5a4e9198_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8da12cbfa5eec23eb72f2dec5a4e9198_JaffaCakes118
Size

6KB
MD5

8da12cbfa5eec23eb72f2dec5a4e9198
SHA1

6e7e1827bf78c0aeeb2b3c94a09fc38b6cc8a16a
SHA256

df82de4174156ea1131d44957c2df388424b3d084445399114f36ef5fdf7ac0c
SHA512

79a38f6ba2e3f1726d2c51a3c12291fe5d6575977d9a7bdffc6153db937cda48606a94da4cc0b909a626bb9a8c0b8282a2e07959d0a86c5941fd5a10038abcbc
SSDEEP

96:nP/pErQvS4+i/2IOGH55BO/wWzR6iCWx9kXOpPFxaZF12E:nJEfO/xOwJXWEckXMPFMrV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8da12cbfa5eec23eb72f2dec5a4e9198_JaffaCakes118

Files

8da12cbfa5eec23eb72f2dec5a4e9198_JaffaCakes118
.exe windows:1 windows x86 arch:x86

a9be9bbd09e99de3b6e8045646214ae6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetProcAddress
lstrcmpi
CreateFileMappingA
MapViewOfFile
CreateFileA
lstrlen
DeleteFileA
GetStartupInfoA
CopyFileA
GetFileSize
GetFileTime
GetModuleFileNameA
GetModuleHandleA
CloseHandle
SetEndOfFile
GetWindowsDirectoryA
GetTickCount
CreateProcessA
ExitProcess
SetFilePointer
SetFileTime
Sleep
UnmapViewOfFile
VirtualAlloc
VirtualFree
lstrcat

wsock32

WSAGetLastError
WSACleanup
socket
send
recv
gethostbyname
connect
closesocket
WSAStartup

advapi32

RegSetValueExA
RegCloseKey
RegCreateKeyExA

user32

MessageBoxA
EnumWindows

Sections

CODE
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE