dbb04d78eddba37d3574c9cb03a83efa_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dbb04d78eddba37d3574c9cb03a83efa_JaffaCakes118
Size

36KB
MD5

dbb04d78eddba37d3574c9cb03a83efa
SHA1

fb9fa919eea09e091a45bf8aa94f30334aaca3f2
SHA256

2592e81b6881e265be737e4249e0a67db1fe2f5750bad3c18f082e8de5671c05
SHA512

177adbbb27f07081daf04ae095dc74eb2796cd9d2302c796d19788e0be5385cf6225f661166f381c349578cffcc0c858fc4c0442dd399623e18c298657ca023a
SSDEEP

768:KIWhpA3KLwDPQQ8IHOTftkhy15dDzgQ9nIozUEGW+E:KloaLwDUIHIftkM15dznIozJG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dbb04d78eddba37d3574c9cb03a83efa_JaffaCakes118

Files

dbb04d78eddba37d3574c9cb03a83efa_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f67869fc5f9b38bba5f511517aa79e2d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
ContinueDebugEvent
CreateFileA
CreateThread
ExitProcess
GetCurrentDirectoryA
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetProcAddress
GetThreadContext
GetTickCount
IsDebuggerPresent
ReadFile
SetThreadContext
Sleep
VirtualAlloc
VirtualFree
VirtualProtect
WaitForDebugEvent
WriteFile

wsock32

gethostbyname
WSAStartup
WSACleanup

user32

MessageBoxA

Sections

.text
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 822B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE