0cc0871a0feca0e7f5a21cac3d90f4d9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0cc0871a0feca0e7f5a21cac3d90f4d9_JaffaCakes118
Size

64KB
MD5

0cc0871a0feca0e7f5a21cac3d90f4d9
SHA1

7cbfe80eae99761bf2468e96cafa6578509d3cd4
SHA256

44f3c73954b82215a83802a5a8a711e34318f5c2a5cc99fc23c6bf83ad122100
SHA512

7cf037eae3d6c1fb1543679a582ce28273e1de36b3e8d656a9b2406b62685e5353ec8a874e3b79b9dba627d24a7be357c82ba72e6f2eae7aa72f7579f76e30fa
SSDEEP

768:hYgfjEJSFNCNYoZg04qFuPwhfwVfZaIa7oLgoFoYZ3oGzAyi3DsYSQsgn:hbRfToZ14qUPwhIZycLqGWyiRd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0cc0871a0feca0e7f5a21cac3d90f4d9_JaffaCakes118

Files

0cc0871a0feca0e7f5a21cac3d90f4d9_JaffaCakes118
.dll windows:4 windows x86 arch:x86

458bff1331382dd6c181ffd6877ebe19

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ald.pdb

Imports

kernel32

OpenEventW
FindResourceExW
FindResourceW
SetLastError
HeapDestroy
GetProcessHeap
HeapFree
IsBadStringPtrA
Beep
HeapReAlloc
HeapAlloc

rpcrt4

NdrServerCall2
RpcStringFreeW
RpcServerInqBindings
RpcServerUseProtseqW
RpcAsyncCompleteCall
NdrAsyncServerCall
UuidFromStringW
RpcRevertToSelfEx

crypt32

CryptUnprotectData
CryptProtectData

Sections

.text
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 4KB - Virtual size: 1B

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 418B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ