40e52611f84314d1cd0eaa757833849b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

40e52611f84314d1cd0eaa757833849b_JaffaCakes118
Size

15KB
MD5

40e52611f84314d1cd0eaa757833849b
SHA1

3d7fe9b0d345d7088ba8704dc711d4532817b36f
SHA256

e8eb8c922caaf74e2b4f6ee21a16a9c5e81fc3b110e70623c67b110ae820727c
SHA512

1dcb1ccd26112793f46b63b7df512626f66067b9bc06f23c9becf301338dbfdac2f097e8e1e038447ef1f1bffddac2d67ca454ddcb57e43ac5840acad09fb73b
SSDEEP

192:dBFTUYy2b4jOzLJhinWCIZsUZLarltuizsNWt1Omdl2SP2LsuGCn:nFTUYyI1hmKsq6tbsiD2Dv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40e52611f84314d1cd0eaa757833849b_JaffaCakes118

Files

40e52611f84314d1cd0eaa757833849b_JaffaCakes118
.exe windows:1 windows x86 arch:x86

1b51dbe324150688ce5e3a0742d34a26

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

accept
htonl
SetServiceA
gethostbyaddr
listen
closesocket
bind
htons
sethostname

urlmon

ZonesReInit
DllCanUnloadNow
IsAsyncMoniker
IsValidURL
URLDownloadW
Extract
CreateAsyncBindCtx

Sections

.text
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: 20B - Virtual size: 6KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE