20c43ff85f19f1b1ffaa2d6d1aae146f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

20c43ff85f19f1b1ffaa2d6d1aae146f_JaffaCakes118
Size

148KB
MD5

20c43ff85f19f1b1ffaa2d6d1aae146f
SHA1

1c80843e2c77076920b5b0c9c7050be148924cec
SHA256

38cdf3439efb2b1b1bae68ee95af77cc5d84974feacd6d04411fd3033fd36fb3
SHA512

3388bb69e34363f5d652a73239666d0e5cf7c8f1f3069e5448e57701890ba5e380f9a87c4afb4491a9eefaf6dc19baff8599d21203388cbb963c3ee0fcad72be
SSDEEP

3072:AbPZaqNxUWKPWk8vNcbApDbvDTPJFgCVnhb3vi+TBfR2rK:8ZaUuPJ2hLJnNfi+TBJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20c43ff85f19f1b1ffaa2d6d1aae146f_JaffaCakes118

Files

20c43ff85f19f1b1ffaa2d6d1aae146f_JaffaCakes118
.dll windows:4 windows x86 arch:x86

77039296ad5c841987927924af51993d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

picn20

PegasusUnload@8
_PicOp32@8
PegasusLoadFromRes@16

kernel32

GetProcessHeap
HeapReAlloc
HeapFree
HeapAlloc

Exports

Exports

_Pegasus@8

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ