0e156c62c62b98d6879a8b91935ae52f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0e156c62c62b98d6879a8b91935ae52f_JaffaCakes118
Size

156KB
MD5

0e156c62c62b98d6879a8b91935ae52f
SHA1

778f53fbcf3de2fa37693fd590f28f6e5ca7cc17
SHA256

74031da66901361484d743bfb5afd0ec626b854c7ac7ae0927d88bae41e227aa
SHA512

ed4972d9fd93cea9e0282f1785babb9846a76cdb44707f9f1a0acd5b3042c20ef241df27c20f4694bef3f164091f95f980585934954920ac34d8a5305a006ae7
SSDEEP

3072:aGd5SXDt0QG8AbXDKNd/j48+Xv/ja2U9ppe:Vd5fJ/8+nU9p0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e156c62c62b98d6879a8b91935ae52f_JaffaCakes118

Files

0e156c62c62b98d6879a8b91935ae52f_JaffaCakes118
.dll windows:4 windows x86 arch:x86

47b95eaa8a92898962a601a6fb44ee48

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_adjust_fdiv
free
malloc
_initterm

kernel32

DisableThreadLibraryCalls

Exports

Exports

JGS7DecodeBlock
JGS7DecodeBlockQuery
JGS7DecodeCreate
JGS7DecodeDestroy

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 388B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 820B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 178B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE