JaffaCakes118_2d64894b85780943f41fee37c76504d4 | Triage

Sharing

General

Target

JaffaCakes118_2d64894b85780943f41fee37c76504d4
Size

85KB
MD5

2d64894b85780943f41fee37c76504d4
SHA1

ce248c38cfe81a249958c218f20d4d87e0afed1e
SHA256

ab95f595c75dc8d8a304780c62bb0ecd2fad9743cbc0048caf5802341c6c2ac8
SHA512

87123e780db6c428f08aca3d9fe25a3d89c0524d528334f2cf6d998245eebcbb8fae27596d34f768e3f9acc7e45eeecb8ab17c603ccc8ec43ec3049f0bc779ad
SSDEEP

1536:uI9mzdwo+mjCIhiaHKM6uMOcy7v1RZM3vLL1lMQ8cAAV0JzcH:uIwdPjhiaHQyBRZIj3JTV0JzM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_2d64894b85780943f41fee37c76504d4

Files

JaffaCakes118_2d64894b85780943f41fee37c76504d4
.exe windows:4 windows x86 arch:x86

26d1f3e93d879476cd929e921e5b7ca0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CreateThread
EnterCriticalSection
ExitProcess
ExitThread
GetCommandLineA
GetModuleFileNameA
GetStdHandle
InitializeCriticalSection
LeaveCriticalSection
ReadFile
SetConsoleTextAttribute
Sleep
WriteConsoleA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrcpynA
lstrlenA

ws2_32

WSAStartup
accept
bind
closesocket
getpeername
htons
inet_ntoa
listen
recv
send
shutdown
socket

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 790B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vrdata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE