2fc402a68913061c6aa35e32161e2a5e_JaffaCakes118 | Triage

Sharing

General

Target

2fc402a68913061c6aa35e32161e2a5e_JaffaCakes118
Size

8KB
MD5

2fc402a68913061c6aa35e32161e2a5e
SHA1

f3486f4db4340e6ee025c70c5cc31dfd5d95643f
SHA256

71184609d68095fda1adb7b757d5aa20e7cf3a57044b3ca26b4063c55e161001
SHA512

87ebfb01d10b6a60b87e65c37a22ee862e538794161c3d68aff8a6b6f0d1f6e3c4878397e87e067b8605e4863e8cadced1af6f3b431b4dee3023ba6c4700859e
SSDEEP

192:6vck8YarPQnLtTCPZy5fCN+yZKpRGvU4pc:6vcXPSTCPM5CN4GvU4pc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2fc402a68913061c6aa35e32161e2a5e_JaffaCakes118

Files

2fc402a68913061c6aa35e32161e2a5e_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e2f14eac1917776fe474971288981cf1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

connect
WSAStartup
inet_addr
ioctlsocket
WSAGetLastError
htons
recv
socket
select
closesocket
gethostbyname
send

shlwapi

SHSetValueW

kernel32

GetTickCount
Sleep
GetModuleHandleW
CreateThread
LocalFree
CloseHandle
ReleaseMutex
CreateMutexA
lstrcatW
LocalAlloc
GetLastError
lstrlenW
GetModuleFileNameW
GetFileAttributesW
ExitProcess
lstrlenA
CreateProcessW
WaitForSingleObject
CopyFileW

user32

wsprintfW

shell32

SHGetSpecialFolderPathW
ShellExecuteW

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE