42717b9a22c1c06decc2a6a0bb43cee1_JaffaCakes118 | Triage

Sharing

General

Target

42717b9a22c1c06decc2a6a0bb43cee1_JaffaCakes118
Size

14KB
MD5

42717b9a22c1c06decc2a6a0bb43cee1
SHA1

11872f28b0291f8a15c3e598dac7f381b6db6be1
SHA256

933efe1c3c8ae0c1f9f2fb15d061c8f2e20c95e3570652c1edc9c30f7b4ef457
SHA512

a6fda69c051001ac62958df73117ae330f12ee98dc0bf9a6365ba53dacb9a09951662f774a266c39d628946f0b05ed5b617923603c3050ad797235bf9256ee2d
SSDEEP

384:h5DhRJf87bDbBkKPVwD0N71Zmf2twa0OS0:h5DrJf87Pte2bY0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
42717b9a22c1c06decc2a6a0bb43cee1_JaffaCakes118

Files

42717b9a22c1c06decc2a6a0bb43cee1_JaffaCakes118
.exe windows:5 windows x86 arch:x86

ebab4b1e78ebc7808ca2d2afcaa23e5e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\dev\ximko\main\Release\ximko.pdb

Imports

ws2_32

socket
send
htons
WSAConnect
inet_addr
inet_ntoa
gethostbyname
WSACleanup
WSASocketA
WSAStartup
sendto
setsockopt

ntdll

memcpy

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE