16ed790940a701c813e0943b5a27c6c1_JaffaCakes118 | Triage

Sharing

General

Target

16ed790940a701c813e0943b5a27c6c1_JaffaCakes118
Size

18KB
MD5

16ed790940a701c813e0943b5a27c6c1
SHA1

078c056e76df6018c254c61125986426f73524a1
SHA256

5559fcc93eef38a1c22db66a3e0f9e9f026c99e741cc8b1a4980d166f2696188
SHA512

a27cb9d471adb7146ac421df0eed0f9d51097707097499c1a2cbb2f3e08a41a41d9e52300d737b0f8fabbee8223f827fec8c97d2e63b43118a4b9f8147c26ee6
SSDEEP

384:qftfsIczWxxdJHmgDVvkpzF4YuygFc51u8:qtf6zWxxdpZFrY9B4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16ed790940a701c813e0943b5a27c6c1_JaffaCakes118

Files

16ed790940a701c813e0943b5a27c6c1_JaffaCakes118
.dll windows:5 windows x64 arch:x64

648f2e0978686ef5cec5d47a5fb7fd2b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msi

ord120
ord74
ord26
ord160
ord159
ord114
ord49
ord32
ord8

kernel32

RtlUnwindEx
CloseHandle
WaitForSingleObject
SetLastError
TerminateThread
CreateThread
VirtualProtect
VirtualAlloc
VirtualFree

user32

wsprintfW

advapi32

RegQueryValueExW

Exports

Exports

StartAction

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ