fa3e1ae6faaff96af81d2963b0db6379_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fa3e1ae6faaff96af81d2963b0db6379_JaffaCakes118
Size

8KB
MD5

fa3e1ae6faaff96af81d2963b0db6379
SHA1

9a72adf603973a1ac8539e0b684ae366d9c8faf7
SHA256

ce546d23639c13791a56d3a0cbefa8182a3dd2cd26ac37fe191c7566077ba7ff
SHA512

7844b40de46be592615697a5746bee9c08a5beb115bdcf3655b4e658811ded084dd2545a50e0c5b9ace339047ce9e2d1f72d987e355c92a3e579facdf7cab4d8
SSDEEP

96:LLr69nZEJcpOGcWLwxiZE0y1xKTkjC4NhheyiMt:XCZEycWLqME6TkG4NhhB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa3e1ae6faaff96af81d2963b0db6379_JaffaCakes118

Files

fa3e1ae6faaff96af81d2963b0db6379_JaffaCakes118
.exe windows:4 windows x86 arch:x86

aacd4ed49ff69722624f516463decb01

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
GetModuleHandleA
GetWindowsDirectoryA
ReadFile
Sleep
GetCommandLineA
lstrcatA
lstrcmpA
lstrcpyA
lstrlenA
ExitProcess
CreateMutexA
CreateFileA
CopyFileA
WritePrivateProfileStringA
CloseHandle

user32

SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
GetForegroundWindow
GetKeyNameTextA
GetMessageA
GetWindowTextA
RegisterHotKey

wsock32

inet_addr
htons
recv
send
socket
gethostbyname
connect
closesocket
WSAStartup
WSACleanup
inet_ntoa

advapi32

RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE