a54a98ae11b42fbaaa6ce6faba0ea615_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a54a98ae11b42fbaaa6ce6faba0ea615_JaffaCakes118
Size

38KB
MD5

a54a98ae11b42fbaaa6ce6faba0ea615
SHA1

766d1710c467183dbd9b647f1388268df3603881
SHA256

16bac4185ff29d3fd26619abc5e899519dad9f5c9c1225358ef7c0954f1f7965
SHA512

20046daea7111b3a51ceabe04d6455702f5f81ec521aa53d15c643167a2b5a6988996b4c8925e07c03c6a8e702ebf7f98d95d8f450fa383a16d762a3e1ea8f28
SSDEEP

768:P8QWmPEyFdrzaykCt7VcaytsgdXzWwxP2ildS5ih/PlxGx+KdEFo:PWL+dLk4SsgdT2ilA56zG8yE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a54a98ae11b42fbaaa6ce6faba0ea615_JaffaCakes118

Files

a54a98ae11b42fbaaa6ce6faba0ea615_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5f954498c3055f91b8bac07ab32b0a45

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadFile
CreateFileA
CreateThread
ExitProcess
GetCurrentDirectoryA
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetProcAddress
GetTickCount
IsDebuggerPresent
CloseHandle
Sleep
VirtualAlloc
VirtualFree
VirtualProtect
WriteFile

wsock32

gethostbyname
WSAStartup
WSACleanup

user32

MessageBoxA

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 708B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE