b9f15ff872aba3d0d6c1f4b731c0cd12_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b9f15ff872aba3d0d6c1f4b731c0cd12_JaffaCakes118
Size

12KB
MD5

b9f15ff872aba3d0d6c1f4b731c0cd12
SHA1

de79b5b70aba5965463044e70f609fa336bb4bdc
SHA256

5ad64a0ac7bdacfbf290439e46ed763d257e6e3dcf3cf56b1687123e2fd202a1
SHA512

159846c37ffc2ef375d3f8d6f25ac82c12829718427dd403ea1f6465dad2137302168cbef94329672251a7d8fafd49fa5a1f9274544ef95a645150d6f0e53042
SSDEEP

48:OEP+KwdSuN1ZiLFVrUmpckcWjMuHWmkjXgQB8Bo6h25Bb+AM1CdSAjjKa9UAJaBn:nPZjun0LFVoXuMvCQH6hSB+RCris4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b9f15ff872aba3d0d6c1f4b731c0cd12_JaffaCakes118

Files

b9f15ff872aba3d0d6c1f4b731c0cd12_JaffaCakes118
.exe windows:1 windows x86 arch:x86

0a090070b3ad205c85f75a21cb2e79fb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

wsock32

sendto
connect
WSAStartup
recvfrom
socket
shutdown
send
bind
WSAGetLastError

kernel32

ExitProcess
GetModuleHandleA
GetModuleFileNameA
GetProcAddress
LoadLibraryA
DeleteFileA
GetLastError
WriteFile
GetCurrentDirectoryA
CreateFileA
Sleep
SetCurrentDirectoryA
FindNextFileA
RegisterServiceProcess
ReadFile
FindFirstFileA
CloseHandle

advapi32

RegSetValueExA
RegCreateKeyExA
RegCloseKey

Sections

CODE
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ