c7763bae3376a9f2865a1a18e84c259e_JaffaCakes118 | Triage

Sharing

General

Target

c7763bae3376a9f2865a1a18e84c259e_JaffaCakes118
Size

80KB
MD5

c7763bae3376a9f2865a1a18e84c259e
SHA1

8c6efe653280f92ebadf0267b2601eaa7c9802ee
SHA256

1d0d63250b027ebd2b28368414e65da0823edb2650cdea42d8b713e5ffaf8ec5
SHA512

ff2763232ef8a34966fc69ab473ff5876130bd1b463ed3897dde84f52473c7d3d32ca0f9115e7df48879cf0d6dee725d6f9b2dd4d7bf10672f83f21cb8b94a7c
SSDEEP

1536:cy+p4hs6FJJIG9t5UAXg57GIOOnToIfV:cX4hs6lIot5E57kqTBfV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c7763bae3376a9f2865a1a18e84c259e_JaffaCakes118

Files

c7763bae3376a9f2865a1a18e84c259e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d41f6dec2d6c410b431d12241ca0d99f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAStartup
bind
listen
accept
inet_addr
gethostbyname
htons
connect
closesocket
socket
send
recv

shlwapi

wnsprintfA
StrStrIA
StrStrA

advapi32

CryptDestroyKey
CryptReleaseContext
CryptAcquireContextA
CryptGenKey
CryptExportKey

kernel32

CreateMutexA
CreateThread
ExitThread
FileTimeToSystemTime
GetLastError
CloseHandle
Sleep
ExitProcess
GetTickCount
HeapFree
IsBadWritePtr
TerminateThread
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
GetProcessHeap
lstrlenA
HeapAlloc
HeapReAlloc

Sections

.text
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ