a5a6a1ef02a9c52487a1f20b750ef381_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a5a6a1ef02a9c52487a1f20b750ef381_JaffaCakes118
Size

4KB
MD5

a5a6a1ef02a9c52487a1f20b750ef381
SHA1

be01a65343afcb98bc5f227af1ca8e21e446be5f
SHA256

7c6570fddff352209b6e837a5dc8e7ead2e7abe167d8911a553c5a10931fd10e
SHA512

8dfb421f972a6722c2d53559a5ba5d52fc3834fd67560980eb37a05fbc6aa55074405bbf3e4a7c6c18fa26811b429c384fe4e74bd3514b5e9bf3ab14b4e1d431
SSDEEP

96:17U2HeMQpC1X4NA1FDIh7FJiKM3oQRdr2K+:1J9fC2TDIh7bXc/7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a5a6a1ef02a9c52487a1f20b750ef381_JaffaCakes118

Files

a5a6a1ef02a9c52487a1f20b750ef381_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e3c38da9d78eca66e2b103c57fc32412

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

connect
WSAStartup
htons
recv
socket
closesocket
gethostbyname
send

kernel32

GetModuleFileNameA
GetProcessHeap
lstrcpyA
CreateThread
ExitProcess
lstrlenA
HeapAlloc
GetTickCount
CopyFileA
Sleep
GetFileAttributesA
lstrcatA

advapi32

RegOpenKeyExA
RegCloseKey
RegSetValueExA

shell32

SHGetSpecialFolderPathA

Sections

.text
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 814B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE