1547ed0b65ac48f48178a9f26f7f4207_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1547ed0b65ac48f48178a9f26f7f4207_JaffaCakes118
Size

100KB
MD5

1547ed0b65ac48f48178a9f26f7f4207
SHA1

de1bd2d6b7797d27c3ada36cd2572647dd8c5a5b
SHA256

edb1b0035303af867ae72ded656cb571c34289bdf961dcc8cd1de876ef3d9676
SHA512

bd226f76cec6b6dc829a5c6dfb34e3a8246abdd2d877b3fd04e5750e0900b382a6c0c894be6cf40573620c790ec84fde7f43f01ac891fece048133c3bd2f11d0
SSDEEP

3072:3qGlek/EG42/eO4vq6Gq+ITWrRFbdJRuELKTGjIb:3VUksIv3zRFbdJRuEc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1547ed0b65ac48f48178a9f26f7f4207_JaffaCakes118

Files

1547ed0b65ac48f48178a9f26f7f4207_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

ee213daa05bedabdb0a12ddf6e0fcf5b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryExA
GetProcAddress
FreeLibraryAndExitThread
EnumDateFormatsW
ContinueDebugEvent
GetDriveTypeA
ShowConsoleCursor

advapi32

FreeSid

oleaut32

SysFreeString

user32

wvsprintfA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
Pobeofp
DllMain
DllRegisterServer
DllUnregisterServer
ServiceMain

Sections

.none
Size: 97KB - Virtual size: 264KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.none2
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 224B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mnon
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_MEM_READ