d71d14ce52aa330db88bb5a8dc141535_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d71d14ce52aa330db88bb5a8dc141535_JaffaCakes118
Size

196KB
MD5

d71d14ce52aa330db88bb5a8dc141535
SHA1

c0c2a2ecfde48e55a8e950e46e7d5c5dd4ffc01a
SHA256

f6fa8b116c3522e6d8ec2f4635b69058108b21272011d066ad5b0d25872f8518
SHA512

8f8cda8b9260332fd1126d8b4314c790f98ff13be53eb6f3c841be30dcc075e89f77dcd4f1a0b0275b44196ff7b6475dbcc1c747447eb6a991a094e3901f3233
SSDEEP

6144:gGdNA5C4Ic4zvn2ScjNzIslPwIhijYyTX:gGbAEKAvnD+pNhit

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d71d14ce52aa330db88bb5a8dc141535_JaffaCakes118

Files

d71d14ce52aa330db88bb5a8dc141535_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

aspnet_wp.pdb

Exports

Exports

PMAppendLogParameter
PMCallISAPI
PMCloseConnection
PMDoneWithSession
PMEmptyResponse
PMFlushCore
PMGetAdditionalPostedContent
PMGetAllServerVariables
PMGetBasics
PMGetClientCertificate
PMGetCurrentProcessInfo
PMGetHistoryTable
PMGetImpersonationToken
PMGetMemoryLimitInMB
PMGetPreloadedPostedContent
PMGetQueryString
PMGetQueryStringRawBytes
PMGetServerVariable
PMGetStartTimeStamp
PMGetTraceContextId
PMGetVirtualPathToken
PMIsClientConnected
PMMapUrlToPath
PMTraceRaiseEvent
PMWriteBytes
PMWriteHeaders

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tqn
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE