f1706207dcf3e7bb4964dc50487b189a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f1706207dcf3e7bb4964dc50487b189a_JaffaCakes118
Size

52KB
MD5

f1706207dcf3e7bb4964dc50487b189a
SHA1

63127296357bc8fe0ade90fc45d79274a61743ab
SHA256

ddac8d7b22c06584da956b18e7bb226f56a0f1f0751be9e6ec8ed389111e739b
SHA512

c1657aba40107a502d0f5af89677b61afd6c8e3f057f043eb46e5af1fb359e67fd3a331d78b397f9266d46bcbde8ecc8c1821a4b2707be06a0b66cf430fa7244
SSDEEP

768:hE+6jl6d4ETW2AHeSsWWh4cQtpWCF21G9yfJbWGWrCYmIyOSpcqM8gn:ht6Z6d4sAqlh4cQtpbFEf1WGnWfES

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f1706207dcf3e7bb4964dc50487b189a_JaffaCakes118

Files

f1706207dcf3e7bb4964dc50487b189a_JaffaCakes118
.dll windows:4 windows x86 arch:x86

9fe8ad4136c704ba730ca7849fb2c993

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ald.pdb

Imports

kernel32

Beep
HeapReAlloc
HeapDestroy
OpenEventW
FindResourceExW
FindResourceW
SetLastError
HeapAlloc
GetProcessHeap
HeapFree
LoadLibraryW
LoadLibraryA

rpcrt4

RpcStringBindingParseW
RpcBindingVectorFree
RpcBindingToStringBindingW
RpcEpUnregister
RpcEpRegisterW
RpcServerListen
RpcServerRegisterIfEx
RpcServerRegisterAuthInfoW
RpcServerInqDefaultPrincNameW
RpcImpersonateClient
UuidCreate
UuidToStringW
RpcMgmtStopServerListening
RpcAsyncAbortCall

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 418B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ