0ea0413ae1b9ca9bc6bcf93424cf4b37_JaffaCakes118 | Triage

Sharing

General

Target

0ea0413ae1b9ca9bc6bcf93424cf4b37_JaffaCakes118
Size

44KB
MD5

0ea0413ae1b9ca9bc6bcf93424cf4b37
SHA1

e37ae48bf5360f9fc06675ecdda4eb2ca2c3d78b
SHA256

df7ae7c1184087f61278ba112a73c3f771a19af5ef912b1121229a0651b2df35
SHA512

06482ae98a80fb11e0241b98a175579d54811162283bdfed166e5c31f092d9e6ee6a283b51842c112f58f25ae017691077d046b4f2832e9f571fdbeef3a62916
SSDEEP

768:w3brQvBq/XjQabo3NFulBqsVxDIwZEB7YW:wLrSaMMmGxDtxW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ea0413ae1b9ca9bc6bcf93424cf4b37_JaffaCakes118

Files

0ea0413ae1b9ca9bc6bcf93424cf4b37_JaffaCakes118
.dll windows:4 windows x86 arch:x86

fb64e56ead79ca71df90f5b2e4e45981

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
FreeLibrary
GetProcAddress

ws2_32

WSAStartup
htons
socket
connect
closesocket
send
inet_addr
gethostbyname
inet_ntoa
recv

msvcrt

_adjust_fdiv
malloc
_initterm
free
_onexit
__dllonexit
__CxxFrameHandler
??3@YAXPAX@Z
??2@YAPAXI@Z

Exports

Exports

ServiceMain

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 715B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ