073da8f620cc32ee44302f32c16ea1d7_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

073da8f620cc32ee44302f32c16ea1d7_JaffaCakes118
Size

15KB
MD5

073da8f620cc32ee44302f32c16ea1d7
SHA1

99b0884e68c4185ecc3cd608107df640cc3f2c5d
SHA256

05b9cd790f112bb8cd66fab73dc32e48cbdabcd8d2cabcf9b25b172ec1f80d06
SHA512

cb04143840cef40459fc2d973c32d12a6a2cb39b6dc75e4ac6876f61968666b0dbf3fa9c1f47cc61ec403d80dcbb78771a7f70edac8bef0199db877dba6c42c9
SSDEEP

192:6Wus8h0hB6dQoey/yENOQFY9+5twLjWmmoBcEPtBp2E99u+BFqqhJ8yGUCn:h8hmB3oeiyw2LjfmoBcOp2p+HhJLGN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
073da8f620cc32ee44302f32c16ea1d7_JaffaCakes118

Files

073da8f620cc32ee44302f32c16ea1d7_JaffaCakes118
.exe windows:1 windows x86 arch:x86

1b51dbe324150688ce5e3a0742d34a26

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

accept
htonl
SetServiceA
gethostbyaddr
listen
closesocket
bind
htons
sethostname

urlmon

ZonesReInit
DllCanUnloadNow
IsAsyncMoniker
IsValidURL
URLDownloadW
Extract
CreateAsyncBindCtx

Sections

.text
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: 20B - Virtual size: 6KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE