d5e574eaf645428bea55263b5c61a431_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d5e574eaf645428bea55263b5c61a431_JaffaCakes118
Size

27KB
MD5

d5e574eaf645428bea55263b5c61a431
SHA1

97064af583bbea07d7ce37b0ea1ef6b258eeb629
SHA256

616f09178e23721c0f037d871a710eb6b746fffcfce08896dcda897f94381c6c
SHA512

a12e0c47f486ca61d57fa1564929d97e32ddf081717d9edf2184dee3a3fcfdfedf4e31fb865f265784637dd4bc351d80bd3cfd0dae027ddb2ccdd48ca9c94f67
SSDEEP

384:Lh0s7DaktLOoZ5lujP6BHM0es6NrBHK4K1Ki9EdnXKrhtR82PY:LbagBnluXmGrBQEFItY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d5e574eaf645428bea55263b5c61a431_JaffaCakes118

Files

d5e574eaf645428bea55263b5c61a431_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c5b4cb48488466e832fb84994a31a5a2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegCreateKeyA
RegSetValueExA

kernel32

AddAtomA
CopyFileA
CreateProcessA
ExitProcess
FindAtomA
GetAtomNameA
GetModuleFileNameA
SetUnhandledExceptionFilter

msvcrt

_close
_sleep
_write
__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_iob
_onexit
_setmode
abort
atexit
atoi
fclose
fopen
free
malloc
memcpy
memset
remove
signal
sprintf
strlen

ws2_32

WSACleanup
WSASocketA
WSAStartup
closesocket
connect
gethostbyname
htons
inet_addr
recv
send
socket

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 400B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 112B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE