d08267342b7f38210b7a84feb4605f12_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d08267342b7f38210b7a84feb4605f12_JaffaCakes118
Size

80KB
MD5

d08267342b7f38210b7a84feb4605f12
SHA1

32572a2e68984694c5c3f05bd3abf350667c1ccd
SHA256

ce58a19606b56db1e3a14eac214a333376fc5aa9b847cfe8cd159024aaa38e80
SHA512

9337af9736a494f2f059f13f4377ae722928c493fe229626e5b2de7698157d7ba7022f29cd19cfa730233c0fd89fc19b1997d6397a145db08802d7be38ce973d
SSDEEP

1536:5FQcecFy+5aKcLlWaHIbvLuxjvYCvsTJxmsqhS:5LFYLLcu6kgxm+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d08267342b7f38210b7a84feb4605f12_JaffaCakes118

Files

d08267342b7f38210b7a84feb4605f12_JaffaCakes118
.exe windows:4 windows x86 arch:x86

045655b91857db0d9cb748d071691d9b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemTimeAsFileTime
GetProcessHeap
SetSystemPowerState
FormatMessageA
GetCPInfo
WriteConsoleW
CloseHandle
GetLastError
OpenMutexA

ole32

CoRevokeClassObject
OleUninitialize
OleInitialize
CoInitialize

ws2_32

accept
closesocket
connect
socket
ioctlsocket
listen
ntohl
inet_addr
select
recv
send
bind

msvcrt

__dllonexit
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
exit
_XcptFilter
_exit
_onexit
gmtime
memcmp
free
malloc
fclose
fseek
fopen

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 444KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ