a424787b697c452bbdfa70b7667fb2f5_JaffaCakes118 | Triage

Sharing

General

Target

a424787b697c452bbdfa70b7667fb2f5_JaffaCakes118
Size

9KB
MD5

a424787b697c452bbdfa70b7667fb2f5
SHA1

e1868e8e1e01d554555b8251de30cbe1594ce0c0
SHA256

79b2229b70386a65b20b733a971dd77ebff2753413b7ee35d4a35bc37b987e6a
SHA512

77c0c72e868c34bb101fce156ef9c081cddbd30862521559de269557a3190b6b1dd0f04f808ff277a86d415ca27eb3f85cbcf09c85d83e843eecfaa320aa26e3
SSDEEP

192:nJBHnLrnY7+/mv9002ZWZM11KzCA5k5mYMZerJkXpj4K:fHoV900i45kUYMZFXS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a424787b697c452bbdfa70b7667fb2f5_JaffaCakes118

Files

a424787b697c452bbdfa70b7667fb2f5_JaffaCakes118
.exe windows:5 windows x86 arch:x86

1b14c629ba2ff37a49730292a9f89212

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSACleanup
recv
bind
listen
accept
getsockname
select
__WSAFDIsSet
WSAStartup
WSAGetLastError
socket
inet_addr
htons
connect
shutdown
closesocket
send

urlmon

URLDownloadToFileA

kernel32

GetCurrentThread
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
OpenMutexA
CreateMutexA
DeleteCriticalSection
lstrlenA
GetEnvironmentVariableA
CreatePipe
SetHandleInformation
CreateProcessA
CreateThread
VirtualFree
VirtualAlloc
VirtualQuery
lstrcmpiA
GetComputerNameA
GetVolumeInformationA
GetWindowsDirectoryA
HeapAlloc
GetProcessHeap
QueryPerformanceCounter
lstrcpynA
GetLastError
lstrcatA
GetTempPathA
HeapFree
Sleep
ExitThread
WriteFile
ReadFile
TerminateProcess
CloseHandle
TerminateThread
WaitForMultipleObjects

advapi32

RegOpenKeyExA
RegEnumKeyA
RegQueryValueExA
RegCloseKey

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE