813a7e2277131dd8b69978f85cae71d2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

813a7e2277131dd8b69978f85cae71d2_JaffaCakes118
Size

50KB
MD5

813a7e2277131dd8b69978f85cae71d2
SHA1

667212402ca09cc0b78cca90d40cd89cd31603d7
SHA256

c39a1e87b7306a06d0916f733a289c6aefdb78da985650284863050a7de1c27b
SHA512

8c249df87711811cef971608e3b83077a9af8c7211befd151cb722dc5f56ec8eaa08269c6fae90a9aa9f95aeda4e81c0bb4797c877b7969e130b37c8b284165c
SSDEEP

1536:dL/dCxmf6l2aw7xhmAnqZaNwwHmOO9cI:dRff6johmAn1RGOgj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
813a7e2277131dd8b69978f85cae71d2_JaffaCakes118

Files

813a7e2277131dd8b69978f85cae71d2_JaffaCakes118
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\JenkinsSlave\workspace\EasiNote5_通用版\EasiNote5_release_升级包+内部渠道包\Dependencies\Cvte.Paint\src\Cvte.Paint.FlashPlayer\obj\Release\net45\Cvte.Paint.FlashPlayer.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ