ac52dc5babee40cef52d35aa6069e7e7_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ac52dc5babee40cef52d35aa6069e7e7_JaffaCakes118
Size

40KB
MD5

ac52dc5babee40cef52d35aa6069e7e7
SHA1

58835ffb3f8c0d291bd52b267266b0508f1a1179
SHA256

70b3cba6bb62f339e2dcc69ad999a2d10b311de8fd4a0f65c3658aa7ca921193
SHA512

2e21a1e9715da380e12854e937a435773f6dab741243d065ab56573d48bd89c0b8d4beaac424694d2dc08f9759d54d7c19a454975d0f835a01afac9875ffdc11
SSDEEP

768:X8pt4Elpt4Es1V/oFDFmiTJiFZsQBxriE1:Et4Eft4EsnLiTq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ac52dc5babee40cef52d35aa6069e7e7_JaffaCakes118

Files

ac52dc5babee40cef52d35aa6069e7e7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5a9eb7d990c6e68229d8f9024a34e439

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

strncmp
strncpy
strstr
atoi
sprintf
strtok
_snprintf
memset

ws2_32

socket
inet_addr
connect
htons
recv
WSAStartup
closesocket
gethostbyname
send

iphlpapi

GetAdaptersInfo

wininet

InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
HttpQueryInfoA

dnsapi

DnsQuery_A

kernel32

CreateProcessA
GetProcessHeap
Sleep
GetThreadContext
HeapFree
HeapAlloc
GetTempPathA
GetCurrentProcessId
GetVersion
GetModuleFileNameA
LoadLibraryA
GetTempFileNameA
GetProcAddress
MoveFileExA
ExitProcess
ResumeThread
WriteProcessMemory
GetModuleHandleA
VirtualAllocEx
SetThreadContext

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE