3dc60781e31c1fcaa7754f986a531dcf_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3dc60781e31c1fcaa7754f986a531dcf_JaffaCakes118
Size

19KB
MD5

3dc60781e31c1fcaa7754f986a531dcf
SHA1

b0c4742d6dc1373ff72520b5ec896c57edba7f58
SHA256

1a4b6e74417428356f1a2900a1c90585b1752a8c54de4dd91c1ce6a66d01573b
SHA512

53b752d2ca40e49b5066fbb871272bb0e5d2c256a8a32f43a3980c9091ce105cf6417c595b5b82cbf774299811fdd10e14099354ade708efc75792838f3e180e
SSDEEP

384:0Ltaq9kq7Cn9uFDUE6rWYzmpSVoDNY2iUYsIH4nNJ:q9RGnoVUrrX2SAxBnNJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3dc60781e31c1fcaa7754f986a531dcf_JaffaCakes118

Files

3dc60781e31c1fcaa7754f986a531dcf_JaffaCakes118
.exe windows:1 windows x86 arch:x86

1b51dbe324150688ce5e3a0742d34a26

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

accept
htonl
SetServiceA
gethostbyaddr
listen
closesocket
bind
htons
sethostname

urlmon

ZonesReInit
DllCanUnloadNow
IsAsyncMoniker
IsValidURL
URLDownloadW
Extract
CreateAsyncBindCtx

Sections

.text
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE