0e9d2b148f1238177bda93bef399e805_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0e9d2b148f1238177bda93bef399e805_JaffaCakes118
Size

17KB
MD5

0e9d2b148f1238177bda93bef399e805
SHA1

cea3af3e91a4441752e99f3e321e7f2131ded352
SHA256

e8121b57ba376e5d9b5cb2a617ef6e369cc7a9cacfd8bf2410e94f760c7e45e6
SHA512

2c5a2ecc79c6e499c71a4f2df35da0bd7e95c5b715265fbbbf1143d1640f91b71dd087e6069cf88e2e9a6298dde5b632d0886a7bef1595188bcc5d3d17ccd6b1
SSDEEP

384:V9p8KuVnQuTF/FPQ8VEKA8BK+IxBHZiQgQeiXwWnE/7L1h1:V9paxfTF/FPns8BKnHZ9eiXwWEz5f

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e9d2b148f1238177bda93bef399e805_JaffaCakes118

Files

0e9d2b148f1238177bda93bef399e805_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e449cc94753c17f136bb343d475295e8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
GetVolumeInformationA
CreateProcessA
Sleep
GetTickCount
CloseHandle
Process32Next
TerminateProcess
OpenProcess
Process32First
CreateToolhelp32Snapshot
CreateThread
GlobalAlloc
GlobalFree
ExitProcess
GetModuleFileNameA
GetLastError
CreateFileMappingA
GetStartupInfoA
GetModuleHandleA

ws2_32

bind
listen
accept
shutdown
recv
WSAStartup
socket
gethostbyname
htons
connect
send
closesocket
WSACleanup

msvcrt

_strdup
_itoa
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
atoi
strlen
fclose
strcpy
strcat
fgets
fopen
fwrite
memset
sprintf
strstr
strtok
rand
srand
strcmp
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
_unlink

Sections

.bss
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE