a76311c2179b73d102b46295bd5e8634_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a76311c2179b73d102b46295bd5e8634_JaffaCakes118
Size

16KB
MD5

a76311c2179b73d102b46295bd5e8634
SHA1

bb6165071da7a74454c05162991356146ec8bce7
SHA256

8924800641e0a71c2831ca93d4a49d24e053030c74967013d94cf698bb623328
SHA512

1e1dc96ec891235995c9a4a7a95490e9c388f8d0177149d5497e89c916bbb695f4993bc9c0d9d30ff8c59238e5f0b0725c258b6552ad4bf2d485472ca3d150ac
SSDEEP

384:HG4K8h05rY9LTasVLHKwXCjMuhdbFlUh3S3FYp8WtW3JWHM:H1K8P9LTasVDFyzhdbAhY5t

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a76311c2179b73d102b46295bd5e8634_JaffaCakes118

Files

a76311c2179b73d102b46295bd5e8634_JaffaCakes118
.exe windows:5 windows x86 arch:x86

3b2d4f142b736c9f118f6ffbe063a323

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

msvcr80

exit

advapi32

RegCloseKey

mswsock

AcceptEx

ole32

CoUninitialize

ws2_32

recv

mscoree

ClrCreateManagedInstance

webengine

GetXSPHeap

Exports

Exports

_STWNDCloseConnection@4
_STWNDDeleteStateItem@4
_STWNDEndOfRequest@4
_STWNDGetLocalAddress@8
_STWNDGetLocalPort@4
_STWNDGetRemoteAddress@8
_STWNDGetRemotePort@4
_STWNDIsClientConnected@4
_STWNDSendResponse@24

Sections

.MPRESS1
Size: 12KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE