4ab77602f2ba9846054bf0f8c6bdc026_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4ab77602f2ba9846054bf0f8c6bdc026_JaffaCakes118
Size

39KB
MD5

4ab77602f2ba9846054bf0f8c6bdc026
SHA1

e8b13e37d663872e1e293b0d8f53e23f8182a3ac
SHA256

b03887fe7c299e71335da76e1f32c6ef1f0c8fc4a51d54bfd53b2300fbd249d7
SHA512

0ff2af9ab176c171fb652a4700b23ee7d5d7bc55fb88dfe8ddcacc792e8d9d63d848c5df2fab7635c11ebbe86e2c7133b4fb347d1900fb4bbfddddeb438d2276
SSDEEP

768:dw6vobK9GHwPD0BExvNeHqLoTHfiFIS8ONGOf1GOpNLusPkCyArY3b:i6vobK9Owb0hlTHUIStXf1GMNXpc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4ab77602f2ba9846054bf0f8c6bdc026_JaffaCakes118

Files

4ab77602f2ba9846054bf0f8c6bdc026_JaffaCakes118
.exe windows:1 windows x86 arch:x86

4171146cb962e3627f1a9bd22db00bb6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

urlmon

Extract
CreateAsyncBindCtx
ZonesReInit
DllCanUnloadNow
IsAsyncMoniker
IsValidURL
URLDownloadW

wsock32

WSAStartup
htonl
SetServiceA
gethostbyaddr
listen
accept
bind
htons
sethostname

Sections

.text
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE