047ad6470aee5f5dfe135983c002df4d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

047ad6470aee5f5dfe135983c002df4d_JaffaCakes118
Size

80KB
MD5

047ad6470aee5f5dfe135983c002df4d
SHA1

d54d5e8d50ac8b4eaa6ddd1046a38cc3f5b4a090
SHA256

0e7668623bef5b9179e80b2a8804413670632030238ddd2392c333a00b83482e
SHA512

79cbf91c12aea8049ea226886e834d8a87cadef51a17728403e9f605b6f01ec451c10bf3322c72168befeea873cff7be7e3c403e0684fd87a9dd234db7034423
SSDEEP

1536:D1qnTQf3YZYMSNKI6eLEXz+w44VUhL7kyBu+oCDATtYE6F:6TokYCBq5gP+osQCE6F

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
047ad6470aee5f5dfe135983c002df4d_JaffaCakes118

Files

047ad6470aee5f5dfe135983c002df4d_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
JmpHookOn

Sections

CODE
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 940B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 202B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ