1036a846405229983c3314157d76a4ed_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1036a846405229983c3314157d76a4ed_JaffaCakes118
Size

13KB
MD5

1036a846405229983c3314157d76a4ed
SHA1

9c47c5c083f0a3795f5a8dcffbe87a9e209a9a03
SHA256

7341496033391014e3b05081f2921e8808fa1e39aa43ab43d06790f19966dc41
SHA512

b02524acba5de62b25e2b9b898ff63309f08049102133d533c26a6beacee69e6245704e41f8b5954b29acc210f4fbc5db5a5737bc4723306826dbdbfa5be1bb3
SSDEEP

384:5o/0956ofiSJKMZMNfm+ZyToqHsryY0TQ:6Yjzi5ZYpMryFQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1036a846405229983c3314157d76a4ed_JaffaCakes118

Files

1036a846405229983c3314157d76a4ed_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f0b6d43a1f254046d68ee542dabf37a7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAStartup
connect
inet_addr
htons
recv
socket
closesocket
gethostbyname
send

kernel32

FindNextFileA
GetVersionExA
CreateFileA
GetFileSize
lstrlenA
WaitForSingleObject
WriteFile
CreateEventA
ReadFile
GetLastError
CloseHandle
VirtualFree
VirtualAlloc
lstrcmpA
CreateProcessA
FindFirstFileA
FindClose
GetModuleFileNameA
ExitProcess
GetProcAddress
LoadLibraryA
CopyFileA
CreateMutexA
GetComputerNameA
GetWindowsDirectoryA

user32

LoadStringA
wsprintfA

advapi32

RegEnumKeyExA
RegOpenKeyExA
GetUserNameA
RegQueryInfoKeyA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey

shell32

ShellExecuteA

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ