246254b757c1fa3e879c992a83898a95_JaffaCakes118

General

Target

246254b757c1fa3e879c992a83898a95_JaffaCakes118
Size

229KB
MD5

246254b757c1fa3e879c992a83898a95
SHA1

796a80bf090aacb7ad4eb5d78adfe7f6ed51ed74
SHA256

6f1ab49285c9c18f7810d56b912b949930f24dc1bead87be301dcd23c7e3abfe
SHA512

a2494d28e937baa0c2d72471d107e2d274fd50df89b9171964bbff871b30b167b7be40334046e4c2e0038380925f5c65cb477925dfbda02fcb77729aa9910c78
SSDEEP

6144:I74JmxxfPhTDCylwp1VvyEl/l/PcReWUCxG9WM3gaP7zqXXT:I7CYZTDCylAfP/l/PcwWUCo9WMwaP7mz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
246254b757c1fa3e879c992a83898a95_JaffaCakes118

Files

246254b757c1fa3e879c992a83898a95_JaffaCakes118
.dll windows:5 windows x86 arch:x86

16cd40a72e17ef2cfa436fb1a80faa11

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
GetProcAddress

ntdll

qsort

advapi32

RegCloseKey

user32

EndDialog

Exports

Exports

CreateAssemblyCache
CreateAssemblyNameObject
DllInstall
SxsBeginAssemblyInstall
SxsEndAssemblyInstall
SxsFindClrClassInformation
SxsFindClrSurrogateInformation
SxsGenerateActivationContext
SxsInstallW
SxsLookupClrGuid
SxsOleAut32MapIIDToProxyStubCLSID
SxsOleAut32MapIIDToTLBPath
SxsOleAut32MapReferenceClsidToConfiguredClsid
SxsOleAut32RedirectTypeLibrary
SxsProbeAssemblyInstallation
SxsProtectionGatherEntriesW
SxsProtectionNotifyW
SxsProtectionPerformScanNow
SxsProtectionUserLogoffEvent
SxsProtectionUserLogonEvent
SxsQueryManifestInformation
SxsRunDllInstallAssembly
SxsRunDllInstallAssemblyW
SxsUninstallW
SxspGenerateManifestPathOnAssemblyIdentity
SxspGeneratePolicyPathOnAssemblyIdentity
SxspRunDllDeleteDirectory
SxspRunDllDeleteDirectoryW

Sections

.MPRESS1
Size: 222KB - Virtual size: 740KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

16cd40a72e17ef2cfa436fb1a80faa11

Headers

File Characteristics

Imports

kernel32

ntdll

advapi32

user32

Exports

Exports

Sections

.MPRESS1 Size: 222KB - Virtual size: 740KB

.MPRESS2 Size: 4KB - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 1KB

.MPRESS1
Size: 222KB - Virtual size: 740KB

.MPRESS2
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 1KB