ffd4f2f6e68c361b3aac461f3b8681d5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ffd4f2f6e68c361b3aac461f3b8681d5_JaffaCakes118
Size

9KB
MD5

ffd4f2f6e68c361b3aac461f3b8681d5
SHA1

cc3b682e9bed882cd10f725033d65352279716c0
SHA256

4b7c2d24167715b42a946d58b9fbb3487c1dbf1b9c49944c60367a0fb0e5864a
SHA512

63119de53cfd96e136840fc9ee5a6c43a4920cff0f78a34f867ec234f7efcc6de3d97e6eb5316711989a6d906082a6bbf501f9fa451fbe86a150916f4427a8f8
SSDEEP

192:Nvck8YarPQnLtTCPZy5fCN+yZKpRGvUu/p8DZxs3O:NvcXPSTCPM5CN4GvUu/pKZxaO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ffd4f2f6e68c361b3aac461f3b8681d5_JaffaCakes118

Files

ffd4f2f6e68c361b3aac461f3b8681d5_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e2f14eac1917776fe474971288981cf1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

connect
WSAStartup
inet_addr
ioctlsocket
WSAGetLastError
htons
recv
socket
select
closesocket
gethostbyname
send

shlwapi

SHSetValueW

kernel32

GetTickCount
Sleep
GetModuleHandleW
CreateThread
LocalFree
CloseHandle
ReleaseMutex
CreateMutexA
lstrcatW
LocalAlloc
GetLastError
lstrlenW
GetModuleFileNameW
GetFileAttributesW
ExitProcess
lstrlenA
CreateProcessW
WaitForSingleObject
CopyFileW

user32

wsprintfW

shell32

SHGetSpecialFolderPathW
ShellExecuteW

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE