16549ab8e181a5924def098a0b6ef995_JaffaCakes118 | Triage

Sharing

General

Target

16549ab8e181a5924def098a0b6ef995_JaffaCakes118
Size

6KB
MD5

16549ab8e181a5924def098a0b6ef995
SHA1

71fc0b134a04eea54c21a37846c6bf5e3aa62fe6
SHA256

a28b8b68cd03f2f11afedc601cc05a23caf0321af61897edb06780704464eaea
SHA512

dde1cbe1a849cc53f67227f6c6ecf91d1f41b0b2c740eb80633db0ac1a6320f82543c1fc5154edaed2b217b2a19d276140c81f8a89439410253484d3676a89d8
SSDEEP

96:Zuj+jWyb7tOtMv80XIh9dXZxMhiGcjGk:I+jWJCk0XYIiGIGk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16549ab8e181a5924def098a0b6ef995_JaffaCakes118

Files

16549ab8e181a5924def098a0b6ef995_JaffaCakes118
.exe windows:4 windows x86 arch:x86

44d556c36e1d9c63f294329d2a401ef7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

SetTimer
SetDlgItemTextA
MessageBoxA
GetDlgItemTextA
EndDialog
wsprintfA
DialogBoxParamA

kernel32

lstrcatA
lstrlenA
RtlZeroMemory
GetPrivateProfileStringA
GetModuleHandleA
GetCurrentDirectoryA
ExitProcess

wsock32

WSAAsyncSelect
WSAGetLastError
WSAStartup
connect
htons
inet_addr
ioctlsocket
recv
send
socket

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ