f568797582d953ddf689dca483f9c10e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f568797582d953ddf689dca483f9c10e_JaffaCakes118
Size

77KB
MD5

f568797582d953ddf689dca483f9c10e
SHA1

6fd800e3a803f7160255c6108fd1618194e1f740
SHA256

bad24c0a2aff284d2f1db561abca0201b536d13bbec5b2f5f672f85e44ff8e1a
SHA512

283f767f8c66cc758fda7d0e6e5837b58b36f079a9d846e5b04dd8aad425ee2b2e6a18fa190226779707a7e2e6419822bffab285e29361bbd62b841162ade525
SSDEEP

1536:bj2ZWg0IhLYTj7wLK9tKNjfG9OUwzqNKkJyyc+WBSaoYAHdRpMfX2Ru:OZWg0IhLYTYLK9tEbHUnsY5WQ2ATK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f568797582d953ddf689dca483f9c10e_JaffaCakes118

Files

f568797582d953ddf689dca483f9c10e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a3e5b147d6632abb3e6c334623092f34

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
lstrcmpA
GetModuleFileNameA
SetPriorityClass
GetCurrentProcess
WriteFile
CreateFileA
lstrlenA
CreateThread
GetSystemDirectoryA
CopyFileA
GetSystemTime
GetCurrentProcessId
GetProcAddress
GetModuleHandleA
GetVersion
LockResource
CreateProcessA
FindResourceA
CloseHandle
LoadResource
GetVersionExA
ExitProcess
TerminateProcess

user32

wsprintfA

advapi32

RegFlushKey
RegCreateKeyExA
RegSetValueExA
RegCreateKeyA
RegCloseKey

ws2_32

bind
connect
htons
inet_addr
gethostbyname
socket
inet_ntoa
recv
listen
send
htonl
WSAGetLastError
__WSAFDIsSet
select
ioctlsocket
WSAStartup
closesocket
accept

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ