1400e973c06f8ba345468e1698002179_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1400e973c06f8ba345468e1698002179_JaffaCakes118
Size

559KB
MD5

1400e973c06f8ba345468e1698002179
SHA1

294ad215db52ed03214b5861d2c3b3d508fde3ec
SHA256

e19371e1ab0535570a4b0ee90019072c9d270515ad985c3d6a3d44d9f7a60fd7
SHA512

bce526ea503c9d539861f059aeeec4d07abff46aa21e8fff411dcc56ad68b81d97d622887a7ccbf94d3338187d1236743c949a36609f8972fe840131689d900a
SSDEEP

12288:bw05h6qB1oBtIqCinVJ+Z4gsX45wVFoI2cW/HBa29m+rvSG:bn/GJ3bUVn5wroX/HFm+jSG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1400e973c06f8ba345468e1698002179_JaffaCakes118

Files

1400e973c06f8ba345468e1698002179_JaffaCakes118
.exe windows:4 windows x86 arch:x86

88f1d53cae5632f763f38e38aaa5501a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
GetModuleHandleA
ExitProcess
EnumResourceTypesA
EnumResourceNamesA
GetStartupInfoA
HeapFree
FindResourceA
LockResource
HeapReAlloc

ole32

CLIPFORMAT_UserFree
BindMoniker
CoPushServiceDomain
CoPopServiceDomain
PropVariantChangeType

ws2_32

listen
WSAStartup
WSAGetServiceClassNameByClassIdA
WSACleanup

Sections

CODE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: - Virtual size: 117B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 116KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 643B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ