02c43850e81e93e870224c5210e8c4c1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

02c43850e81e93e870224c5210e8c4c1_JaffaCakes118
Size

24KB
MD5

02c43850e81e93e870224c5210e8c4c1
SHA1

ac0f74862772fefb082e81b8906442f696b920be
SHA256

e5aa195d8c2c86d0137f50d713e58ba2687484632a44e36d84a08a02d8a740d4
SHA512

3c2142a37c963d54804bdbbb3dc64e5e6cbe63c2bbb8c86bba00c47ff022769fc52947547f1346a826ce621effdb49580b0beebb23e55bd157945a916ed10697
SSDEEP

384:BPfnTsLs+TrF3cSwgs3YllpIqgtuBkSAtCq4tu7U3bjFEYzbQMewYp:BPfT0N/rBIqgtuBkSAmOU3lvbQMetp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
02c43850e81e93e870224c5210e8c4c1_JaffaCakes118

Files

02c43850e81e93e870224c5210e8c4c1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

690bfab8e14f75d9b996a8e13c14e2a4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

urlmon

IsValidURL
CreateAsyncBindCtx
DllCanUnloadNow
IsAsyncMoniker
ZonesReInit
IsValidURL
URLDownloadW

wsock32

htons
sethostname
WSAStartup
ioctlsocket
bind
htonl
SetServiceA
gethostbyaddr
listen

user32

CloseDesktop
DrawStateA
FlashWindow

Sections

.text
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE