0b3fcdf428c0c2088cd2091553ca2601_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0b3fcdf428c0c2088cd2091553ca2601_JaffaCakes118
Size

24KB
MD5

0b3fcdf428c0c2088cd2091553ca2601
SHA1

be983d3f124e56acd3e6ad07a672fa3fc3b82477
SHA256

b5aee839833e65f116213f7b20681b6c2b8442610cc33b33f201869d8bacb869
SHA512

cc4f0a3bec21dfffc43a97a83720138c638419fa15d7dca493a8805deb50000f45ce96917226460c94a24d678e616801d311e779d2a8ee88c0325b7354022db8
SSDEEP

192:PICZnehfKNwy+9hb9BBdq8pJ8cHA7Oia5rNs0QTh6kxTVgnXu8sKz:PrFI6+9hbTPA7OiaWgXoKz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b3fcdf428c0c2088cd2091553ca2601_JaffaCakes118

Files

0b3fcdf428c0c2088cd2091553ca2601_JaffaCakes118
.exe windows:4 windows x86 arch:x86

799b9376effd27ecb5a58eed86d18e9e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
ReadFile
SetFilePointer
CreateFileA
GetProcAddress
LoadLibraryA
DeleteFileA
CreateThread
GetTempPathA
GetWindowsDirectoryA
ExitProcess
WriteFile
lstrcatA
lstrcpyA
CopyFileA
GetTickCount
Sleep

user32

PeekMessageA
wsprintfA
TranslateMessage
DispatchMessageA

msvcirt

??1exception@@UAE@XZ

msvcp60

??_7bad_alloc@std@@6B@

msvcrt

free
??1type_info@@UAE@XZ
??2@YAPAXI@Z
__CxxFrameHandler
sprintf
gmtime
strstr
fclose
fscanf
fopen
atoi
strchr
_stricmp

shlwapi

PathRemoveFileSpecA

advapi32

RegOpenKeyA

ws2_32

WSACleanup
recvfrom
ntohl
sendto
htonl
htons
gethostbyname
inet_addr
socket
WSAStartup
closesocket

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 645B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE