f89ea5e9d6ed04e59c7e8e96902f47bb_JaffaCakes118 | Triage

Sharing

General

Target

f89ea5e9d6ed04e59c7e8e96902f47bb_JaffaCakes118
Size

562KB
MD5

f89ea5e9d6ed04e59c7e8e96902f47bb
SHA1

4e83b29ec466e8a6f5fcc81732ca274306936ce6
SHA256

55e52b88427d52d66e1e2ef81a8aadeb02342087b9a0b320f2278219a582655b
SHA512

92cc96668a139071a19dbd1c0ee18ad5231f90f0f23101fcd0701c5be077987e08d0b50275472f5f7fd3e157b167839f3f349a9da2b7cf1613fd427fb28a842e
SSDEEP

12288:20Et9YDc/Tk4Po4wSSqodPF9C2vTgYnpq42Rl:GtWDcw4o4Ts/9CkniR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f89ea5e9d6ed04e59c7e8e96902f47bb_JaffaCakes118

Files

f89ea5e9d6ed04e59c7e8e96902f47bb_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

CODE
Size: 485KB - Virtual size: 485KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ