edf56f329b9a806170df23bc81a603b6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

edf56f329b9a806170df23bc81a603b6_JaffaCakes118
Size

15KB
MD5

edf56f329b9a806170df23bc81a603b6
SHA1

56a899dddc5dee220a0541e0909f27a5a45da7e7
SHA256

bb7c55ba6e1cea95da1112c88921e373c4566e59d14f0f3960a3082a2e9ce123
SHA512

18746c7da236c6f913b79a495481a7a17e2e8ce9bdb6c376c650f18c31da0bab7cf580cde7df7f08a3a7bd25f2c6a0b8e5bf2235e1ccbd572471f0d29a4e1152
SSDEEP

192:hRD7SaLgwunVHBvGD2t6zxpfljMOf2c6OlkUJC:DD7bkZGat4XxMO/69

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
edf56f329b9a806170df23bc81a603b6_JaffaCakes118

Files

edf56f329b9a806170df23bc81a603b6_JaffaCakes118
.exe windows:1 windows x86 arch:x86

1b51dbe324150688ce5e3a0742d34a26

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

accept
htonl
SetServiceA
gethostbyaddr
listen
closesocket
bind
htons
sethostname

urlmon

ZonesReInit
DllCanUnloadNow
IsAsyncMoniker
IsValidURL
URLDownloadW
Extract
CreateAsyncBindCtx

Sections

.text
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: 20B - Virtual size: 6KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE