035ef3c0ed0a5420e73ec9b016902c49_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

035ef3c0ed0a5420e73ec9b016902c49_JaffaCakes118
Size

27KB
MD5

035ef3c0ed0a5420e73ec9b016902c49
SHA1

3807e60f566298104bf09ea7666742bb95945041
SHA256

494e33c83ba4efe4e39c322f1ea7bfbefb6162bc2e6af6a9632aceb65c1e4427
SHA512

b6559c85b9b3ba7586200569da4011b15114b04ec44b1d60ce57aebad88fc268322fb5fb37e4dd0844ed5e6d44fbeb628ab90f80d2c9c0fb966d76e6341b81ed
SSDEEP

768:DPsEEjZQQ0BiBhBhYuR5CWv9Ay3Ne/Ym:DNEjaWhk0CE9AyM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
035ef3c0ed0a5420e73ec9b016902c49_JaffaCakes118

Files

035ef3c0ed0a5420e73ec9b016902c49_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2def80e33554c9fa7ba605b5986c9ebe

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

bind
WSAStartup
listen

kernel32

CreatePipe
TerminateProcess
VirtualProtect

gdi32

SetRelAbs
StretchBlt
SetICMMode
ResetDCW
UpdateColors
SaveDC
TextOutW
SetDIBColorTable

shell32

SHAppBarMessage
StrRChrIA
StrStrIA

Sections

.text
Size: 13KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ