b220d4d0d8d45883edb2909b0770d125_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b220d4d0d8d45883edb2909b0770d125_JaffaCakes118
Size

33KB
MD5

b220d4d0d8d45883edb2909b0770d125
SHA1

ba1b182c2a07c4b52a43b7789cc59c6b7995a60c
SHA256

a5569ea52518e24b4dc62c5f69b00c3fcdb087e0ab7ccf996bcf851d16a83ae9
SHA512

df54c3b2d1e878b17b8f1d2fdc865513c5c5898aa41b0f4d989f0ef36a369ba77d4bd4510dc1b6adf973bdb6bb88f40d5be051ce2d06fddcee9583da2a59e8f2
SSDEEP

768:C3c2PSLIxjjkJ2sSlYNMiwKIykD2AfCkMOPb+TyqAcMKQCI6n9Lo:GPSLIxvnsSlYNM3KIykD2SMOSKa9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b220d4d0d8d45883edb2909b0770d125_JaffaCakes118

Files

b220d4d0d8d45883edb2909b0770d125_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b27fb800febc67e29d1ed4bcce6e551e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

strncmp
strchr
_chkstk
sprintf
_itoa
atoi
strstr
strncpy
memset
RtlRandom

ws2_32

setsockopt
htons

wininet

InternetOpenA
InternetConnectA
HttpOpenRequestA
InternetQueryOptionA
InternetSetOptionA
HttpSendRequestA
HttpQueryInfoA
InternetCloseHandle

psapi

GetModuleFileNameExA

kernel32

WriteFile
SetCurrentDirectoryA
GetTimeZoneInformation
GetCurrentProcessId
GetWindowsDirectoryA
GetSystemDirectoryA
ReadFile
VirtualFree
VirtualAlloc
OpenProcess
GetSystemTime
GetLocalTime
SystemTimeToFileTime
GetLastError
GetModuleHandleA
LoadLibraryA
GetProcAddress
lstrcpynA
GetProcessHeap
HeapAlloc
HeapFree
GetCurrentProcess
TerminateProcess
GetModuleFileNameA
CreateFileA
Sleep
CloseHandle
SetFilePointer

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE