110d690e70b214577ea6619bbce63cc2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

110d690e70b214577ea6619bbce63cc2_JaffaCakes118
Size

15KB
MD5

110d690e70b214577ea6619bbce63cc2
SHA1

6bbaadca2335ce8367b47fe83569f8c2288c8042
SHA256

593e89f1456a8917c1d1b9825eb578c2658e0c3f6a296947591c9215f307de95
SHA512

a5b203d7071390caf1de6fee5f6822d043d87c74ef488ca60c025aa223da59ce3f2ce289fce74f894dace433caf93267c23b2c3879aceb0e0f74fb28b0c0ca15
SSDEEP

192:T86+VQIYpkyzQqDzsBbpIHwH/32wB+HTtbdhjLPVmTMTGvRJYL3e+Gp5CRCbIwCh:T8HGMf3j8HTljjLZw8jKk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
110d690e70b214577ea6619bbce63cc2_JaffaCakes118

Files

110d690e70b214577ea6619bbce63cc2_JaffaCakes118
.exe windows:1 windows x86 arch:x86

1b51dbe324150688ce5e3a0742d34a26

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

accept
htonl
SetServiceA
gethostbyaddr
listen
closesocket
bind
htons
sethostname

urlmon

ZonesReInit
DllCanUnloadNow
IsAsyncMoniker
IsValidURL
URLDownloadW
Extract
CreateAsyncBindCtx

Sections

.text
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE