26914760f0c86fe84a6ade5936024d88_JaffaCakes118 | Triage

Sharing

General

Target

26914760f0c86fe84a6ade5936024d88_JaffaCakes118
Size

83KB
MD5

26914760f0c86fe84a6ade5936024d88
SHA1

fd921a63cc1949a21564e721c935cb50b65f41d4
SHA256

f43c43166fbe82db9d7f05d008e7dea316140062df8d772d0eea754aeaa0de8c
SHA512

a16473bdb8812abacff3e9b862baed96c5006f3a4a663381156b2923cb773fe76034e3448f4f1fb5e5600b098c4867ee38ce4e9b9460feeee34995b94fde1618
SSDEEP

1536:3RpGxm/NGeDvanuIDHrdJO+qeGdD5Wd2AFMwlY6Lz85syJWvacmxe:3RpGxovanRD4eGd10MwLAsy0a1x

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
26914760f0c86fe84a6ade5936024d88_JaffaCakes118

Files

26914760f0c86fe84a6ade5936024d88_JaffaCakes118
.exe windows:5 windows x86 arch:x86

73cf44678367f1c10698f6bc2f707b4b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

socket
WSAStartup
WSAGetServiceClassNameByClassIdA
WSACleanup
listen

kernel32

HeapReAlloc
ExitProcess
VirtualAlloc
EnumResourceTypesA
GetStartupInfoA
GetModuleHandleA
HeapFree
LockResource
EnumResourceNamesA
FindResourceA

ole32

BindMoniker
CLIPFORMAT_UserFree
CoPopServiceDomain
PropVariantChangeType
CoPushServiceDomain

Sections

CODE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: - Virtual size: 518B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 76KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ