b216567e324ea1740d0f7c7ee0622e3d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b216567e324ea1740d0f7c7ee0622e3d_JaffaCakes118
Size

9KB
MD5

b216567e324ea1740d0f7c7ee0622e3d
SHA1

d66c71f3d0b36b2dae7946e7b96ce710d06f9421
SHA256

4fe34f99617122aeb94931f2fdc7cb9f553cbc8ba657d945049e27c2bc82b867
SHA512

332c3ec82b1615bc6318f984e980612159c6884d9273993c4c4a281ba69216151e6afddfdb90d179d7c4dfc71df1244f1ca02f1e020c4014fdb9ca428244d798
SSDEEP

96:6dHem2OS6zuA7r78LIC9vkym1J8u1tiFgSmPGjHYV2u01S21SpT7C:5VG6Wr78Lza9bqF3jHs2ukPA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b216567e324ea1740d0f7c7ee0622e3d_JaffaCakes118

Files

b216567e324ea1740d0f7c7ee0622e3d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d36e7d575423ff69c05a02a326726205

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA

kernel32

CloseHandle
CreateFileA
CreateProcessA
GetEnvironmentVariableA
GetProcessHeap
GetTempFileNameA
GetTempPathA
GetThreadContext
GetTickCount
GetVolumeInformationA
HeapAlloc
HeapFree
QueryPerformanceCounter
ReadProcessMemory
ResumeThread
SetThreadContext
Sleep
VirtualAllocEx
WriteFile
WriteProcessMemory
lstrcatA
lstrcpyA
lstrlenA

user32

wsprintfA

ws2_32

WSACleanup
WSAStartup
closesocket
connect
htonl
htons
ntohl
ntohs
recv
send
socket

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 416B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE