1617be9827c4b33aa67b089204c8b246_JaffaCakes118 | Triage

Sharing

General

Target

1617be9827c4b33aa67b089204c8b246_JaffaCakes118
Size

7KB
MD5

1617be9827c4b33aa67b089204c8b246
SHA1

18d2f1d15ade72e3a39c1f6652048d2554e71fbc
SHA256

bc7cf654257b5b25b14769a1754802383feff603ac4f9dcb9541981b3ddcc31b
SHA512

4eda97754efcd7ba0faf74a52df863e67fb92c8f61e6f00834ea2799e6e543eb9065adf7f04c2ca5fdffcf8c0fc7de1c0bf3b76ce236cddf2a3ac529c7ff68b2
SSDEEP

96:V83TsC5Xa3IB48w1mfIjLon/fnaSZ0HaSZ0d7Ssm1VxvcmA+6:CDFXa3I28ICOAnaSRSewp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1617be9827c4b33aa67b089204c8b246_JaffaCakes118

Files

1617be9827c4b33aa67b089204c8b246_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6cd17e2473180ec58e42653070b72928

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfA

kernel32

GetVersionExA
GlobalMemoryStatus
LoadLibraryA
LocalAlloc
LocalFree
GetProcAddress
Sleep
WideCharToMultiByte
lstrcatA
lstrcpyA
lstrlenA
GetPrivateProfileIntA
GetLogicalDrives
GetDriveTypeA
GetDiskFreeSpaceA
FreeLibrary
ExitProcess
MultiByteToWideChar

wsock32

socket
send
recv
gethostname
gethostbyname
closesocket
connect

advapi32

RegCloseKey
LookupAccountNameA
RegSetValueExA
GetSidIdentifierAuthority
GetSidSubAuthority
GetSidSubAuthorityCount
GetUserNameA
IsValidSid

shell32

SHGetSpecialFolderPathA

rasapi32

RasEnumEntriesA
RasGetEntryDialParamsA
RasGetEntryPropertiesA

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE