0104862a50565fc9373133e39a8954a8_JaffaCakes118 | Triage

Sharing

General

Target

0104862a50565fc9373133e39a8954a8_JaffaCakes118
Size

118KB
MD5

0104862a50565fc9373133e39a8954a8
SHA1

33499499972eb53b0af27eada69ba84933385fec
SHA256

699f6eb34232c60d91b2999d557a9d9ab8a6ffd797429d44da144d0d45402429
SHA512

ef586a06bb3d1b34fc269c45b23155aac4574ba1c577ade623bed3ebbf0e922d3e3e465efa73d995899b0f00d0188a672cde69a9e9ff970193d96ca7c79114b3
SSDEEP

3072:kB+U/pvyvJjtKeXea6102HPj7e/iMHK/BWC5d6:kBxyvL6e2HPeaMqECe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0104862a50565fc9373133e39a8954a8_JaffaCakes118

Files

0104862a50565fc9373133e39a8954a8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2d07b8a4d02d06c6d33e155dde6c1279

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAStartup
inet_addr
gethostbyaddr
WSAGetLastError
recv
socket
connect
closesocket
send

kernel32

LoadLibraryA
TerminateThread
GetSystemTime
ExitProcess
lstrlenA
MultiByteToWideChar
Sleep
GetProcAddress

advapi32

RegQueryValueExA
RegCreateKeyExA
RegSetValueExA

oleaut32

SysAllocStringLen
SysFreeString

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ