77539eddf1872a26802d6b10865dc0ad_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

77539eddf1872a26802d6b10865dc0ad_JaffaCakes118
Size

244KB
MD5

77539eddf1872a26802d6b10865dc0ad
SHA1

4397d7fb24d39ff0e28d55cf89db59cf6582ce38
SHA256

cd4fb7c5869dee54e79b06c544e91365ae04aa5227f57cb7efca624c07c6a31b
SHA512

b30cf22855915e84884bf89309caec6d37bc0391b59fb98621b7dbfe3ee9cda7acdbbfa1a176aeffacd2d8d1d4fe595205a2885356d92d47e00f1c46960bb84a
SSDEEP

6144:AxGhn2hTerfGMunNYd9FWZvVCC3hKUZ/Qf6MGOiyf4:AxGhnQTeDv2NYdy9IQhKUSIhyf4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
77539eddf1872a26802d6b10865dc0ad_JaffaCakes118

Files

77539eddf1872a26802d6b10865dc0ad_JaffaCakes118
.exe windows:5 windows x86 arch:x86

833136415b495d3a0d32e32d62f82028

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

accept
listen
WSAGetServiceClassNameByClassIdA
WSAStartup
WSACleanup

ole32

CoPushServiceDomain
CLIPFORMAT_UserFree
BindMoniker
PropVariantChangeType
CoPopServiceDomain

kernel32

ExitProcess
GetModuleHandleA
HeapReAlloc
FindResourceA
VirtualAlloc
EnumResourceTypesA
EnumResourceNamesA
HeapFree
LockResource
GetStartupInfoA

Sections

CODE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: - Virtual size: 463B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 428KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 699B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ