01b1c7dd0a7e17f6ca2827e7dae996b9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

01b1c7dd0a7e17f6ca2827e7dae996b9_JaffaCakes118
Size

11KB
MD5

01b1c7dd0a7e17f6ca2827e7dae996b9
SHA1

60f1fcf9b8f679d000c50f1a81e7f96dfe4cd732
SHA256

3549fb14fc2c0facbec89a168890a52d7e75a223ba2bc9c46a7f42a9b906d012
SHA512

508df349968c0d23da2d076a09b87e07c93c03afac0a3be976bcf6200379e7f90534ddfca539522d8143e4cfca21e46c012726d86e99c0939a4c339be68299a8
SSDEEP

192:cIT8EPRM/aHEYxoSNzsKfJt/b9bWN1198HPoEdP1oynAKUSjHdO3vOYtxOA3O9On:hPRME9WSNzTpKN1yPoa1h+KI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01b1c7dd0a7e17f6ca2827e7dae996b9_JaffaCakes118

Files

01b1c7dd0a7e17f6ca2827e7dae996b9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8004b6e7a9e061db8406f8d409471a06

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetWindowsDirectoryA
GetModuleFileNameA
SetThreadPriority
GetCurrentThread
SetPriorityClass
lstrcatA
GetEnvironmentVariableA
GetShortPathNameA
GetStartupInfoA
GetModuleHandleA
CreateMutexA
CopyFileA
WaitForSingleObject
CloseHandle
ExitProcess
CreateThread
GetVersionExA
CreateProcessA
LoadLibraryA
GetProcAddress
FreeLibrary
GetTickCount
Sleep
DeleteFileA
GetCurrentProcess

ws2_32

htons
socket
send
inet_addr
select
WSAStartup
gethostbyname
connect
closesocket
recv

shell32

ShellExecuteA

advapi32

CreateServiceA
SetServiceStatus
StartServiceA
CloseServiceHandle
DeleteService
OpenServiceA
OpenSCManagerA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA

user32

wsprintfA

msvcrt

strcmp
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
memset
sprintf
fclose
fwrite
fopen
strlen
rand
srand
atoi
strcpy
_strnicmp
strtok
strncpy
strstr
strcat
_exit
_XcptFilter
exit
_acmdln

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE