5702ceca15812f87718c4d6edb278e60_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5702ceca15812f87718c4d6edb278e60_JaffaCakes118
Size

185KB
MD5

5702ceca15812f87718c4d6edb278e60
SHA1

254a32cc9bf2819b4b5ecf1280b7bc1ca7ae81fc
SHA256

0168a69e121ffd5b8d50751b797de7820d705c40e61587cd453373bd57a27afb
SHA512

c22e20c665b32d6faed1247730308cdf60d5752403fe111c729698c6d33619f51adb987c95c93ea670ace8cf1c0bb3f17aee4eda4d1b35defdbfe31899c5070e
SSDEEP

3072:85bF/pkDNxFDfu7mnc/PAnUSJFQ+V0SsuzJvcuOiMUOzHM8JnTSKIgnFejAiqT:GZ/aDFfoyFQy1suzJz/ybM8JTYCFeY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5702ceca15812f87718c4d6edb278e60_JaffaCakes118

Files

5702ceca15812f87718c4d6edb278e60_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dc7475abd68863415f7c397aaa9861b3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
memmove
_CIasin
_CIacos
_CIsqrt
_CIlog
floor
ceil
memcpy
localtime
mktime
strlen

kernel32

GetModuleHandleA
HeapCreate
GetExitCodeProcess
HeapDestroy
ExitProcess
FreeLibrary
GetCurrentProcess
WideCharToMultiByte
HeapFree
HeapAlloc
HeapReAlloc
Sleep
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLocalTime
WriteFile
CloseHandle
ReadFile

wsock32

accept
recvfrom
ntohs
closesocket
WSACleanup
WSAStartup
ioctlsocket
recv
WSAGetLastError

winmm

timeBeginPeriod
timeEndPeriod

Sections

.code
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ