d4f6d7f450e08590abd46df51b33cf90_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d4f6d7f450e08590abd46df51b33cf90_JaffaCakes118
Size

207KB
MD5

d4f6d7f450e08590abd46df51b33cf90
SHA1

b4b66d9ea8feb2fe8e56965b2bbe74bb75832c8f
SHA256

6ea32fbe81bca3856de15a241b1b85e0df9e918b05707a1cec58f611bd50d604
SHA512

ab4f866168b4679d2bc8adf913bcfa4b6efaedd27967501ab0a097ce44f33ab8e4664138e3c6cdadfe60ca3f2b595e8106c3060abb4b080ddc47628c84e8f70c
SSDEEP

3072:CgUxnH95tubgGyYO0UWDIKfbPVlpKhn/d2Sw5np4Y5Vq7f09nC10QL+iAiU2kxnQ:6duT6T1oPV0lBe9VufD10g+R2kxQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d4f6d7f450e08590abd46df51b33cf90_JaffaCakes118

Files

d4f6d7f450e08590abd46df51b33cf90_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

aspnet_state.pdb

Exports

Exports

_STWNDCloseConnection@4
_STWNDDeleteStateItem@4
_STWNDEndOfRequest@4
_STWNDGetLocalAddress@8
_STWNDGetLocalPort@4
_STWNDGetRemoteAddress@8
_STWNDGetRemotePort@4
_STWNDIsClientConnected@4
_STWNDSendResponse@24

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.ifc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE