f992515c53881eea41e770c2bdcaa1e3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f992515c53881eea41e770c2bdcaa1e3_JaffaCakes118
Size

84KB
MD5

f992515c53881eea41e770c2bdcaa1e3
SHA1

289f5fe093a89a8a5338f46e9b1b0091bab516a4
SHA256

90b3b25fc7990f54aef5af8dc50a35a9e038abeb0f881bff40b731061ea09857
SHA512

a826cfc83147bb86193ea3dc69f64c4c480b93fb2feef29192d9daaaeccf7d208239dad7f47c7d0262bef83e08c75166d1fb1401be006137b09ed98900c79919
SSDEEP

1536:uniZAEAuYFEnHvd32+Nvbg67/XSeYr7P76gLCocVssiWRZsn7SA:unsouYGnPhe6jirj7WHriWROH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f992515c53881eea41e770c2bdcaa1e3_JaffaCakes118

Files

f992515c53881eea41e770c2bdcaa1e3_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e2f14eac1917776fe474971288981cf1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

connect
WSAStartup
inet_addr
ioctlsocket
WSAGetLastError
htons
recv
socket
select
closesocket
gethostbyname
send

shlwapi

SHSetValueW

kernel32

GetTickCount
Sleep
GetModuleHandleW
CreateThread
LocalFree
CloseHandle
ReleaseMutex
CreateMutexA
lstrcatW
LocalAlloc
GetLastError
lstrlenW
GetModuleFileNameW
GetFileAttributesW
ExitProcess
lstrlenA
CreateProcessW
WaitForSingleObject
CopyFileW

user32

wsprintfW

shell32

SHGetSpecialFolderPathW
ShellExecuteW

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ