e8c31929ecd722a2e9b4a4b6df5faaa6_JaffaCakes118 | Triage

Sharing

General

Target

e8c31929ecd722a2e9b4a4b6df5faaa6_JaffaCakes118
Size

114KB
MD5

e8c31929ecd722a2e9b4a4b6df5faaa6
SHA1

1444e87a79d1415e53ca619fd64468a9b1b72bae
SHA256

e5aff10a38972a68a89578b616cb6332b7b01f4c1900660fcc7591b769c402da
SHA512

608552dfcb011bfc3e7c57f3c6ca8870641effab4434d2953c44d2fe5392874fba9b03499192858580543dca98226e97b6ed5c18642c929163dc3deef2c36036
SSDEEP

1536:2cHXQ/VFpDPWI5Fzm4CQgDKJaccxUtrPIEbV/xRjvlZagwM3HD:N3UFRuI5FyYg+cxUVPI8phvlZagf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e8c31929ecd722a2e9b4a4b6df5faaa6_JaffaCakes118

Files

e8c31929ecd722a2e9b4a4b6df5faaa6_JaffaCakes118
.dll windows:4 windows x86 arch:x86

c2dd8b2417c47c04976d15f19f79dc5b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ald.pdb

Imports

kernel32

Beep
HeapReAlloc
HeapDestroy
OpenEventW
FindResourceExW
FindResourceW
SetLastError
HeapAlloc
GetProcessHeap
HeapFree
OpenSemaphoreA

rpcrt4

RpcStringBindingParseW
RpcBindingVectorFree
RpcBindingToStringBindingW
RpcEpUnregister
RpcEpRegisterW
RpcServerListen
RpcServerRegisterIfEx
RpcServerRegisterAuthInfoW
RpcServerInqDefaultPrincNameW
RpcImpersonateClient
RpcRevertToSelfEx
UuidFromStringW
NdrAsyncServerCall
NdrServerCall2
RpcStringFreeW
RpcServerInqBindings
RpcServerUseProtseqW
RpcAsyncCompleteCall
UuidCreate
UuidToStringW
RpcMgmtStopServerListening
RpcAsyncAbortCall

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrh
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 430B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ