976e21e3bb1b8daa0a50b1d35d7072a5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

976e21e3bb1b8daa0a50b1d35d7072a5_JaffaCakes118
Size

139KB
MD5

976e21e3bb1b8daa0a50b1d35d7072a5
SHA1

0f35bb4a07876172f630539cde417c462cf17576
SHA256

71b53f3a8e1474d93ecfbf6cb0fad56ed96dbc0c86a87935327853d1f6bc79db
SHA512

d31d815cfcb97bfab8a1dbf5318d9cd8cceb2e6f7115beea82b58c01c0f0ca8b0f057916f3b0c73ddd9e6afb59fcc27069744c39290856be1696f8f262968f1b
SSDEEP

3072:kB+U/pvyvJjtKeXea610cWzFFAYFdz4JkAj7m:kBxyvL6ecaFcbK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
976e21e3bb1b8daa0a50b1d35d7072a5_JaffaCakes118

Files

976e21e3bb1b8daa0a50b1d35d7072a5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2d07b8a4d02d06c6d33e155dde6c1279

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAStartup
inet_addr
gethostbyaddr
WSAGetLastError
recv
socket
connect
closesocket
send

kernel32

LoadLibraryA
TerminateThread
GetSystemTime
ExitProcess
lstrlenA
MultiByteToWideChar
Sleep
GetProcAddress

advapi32

RegQueryValueExA
RegCreateKeyExA
RegSetValueExA

oleaut32

SysAllocStringLen
SysFreeString

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ