1c7c7ae83e66ae45c5b34e3bfffa34d3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1c7c7ae83e66ae45c5b34e3bfffa34d3_JaffaCakes118
Size

100KB
MD5

1c7c7ae83e66ae45c5b34e3bfffa34d3
SHA1

d507313cd3b198281dbaafcd1af18295ce2db292
SHA256

e517115cd1c53b6141336aa295b72c7a88a6b7d5e571c59e9b097c569865a746
SHA512

9eeaf44750f87d801a494f900e9dd030ef82c006ea30fc66a72bae3ec9e600d354e57a3307c6e1ff2bedeee4e81a64a321291564083e58810829c5143a381c0c
SSDEEP

3072:o+36L0ylHSvY0sLChIBUmeXS/6rSzrwu3:NqL9Sv8LCqqmySwiw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1c7c7ae83e66ae45c5b34e3bfffa34d3_JaffaCakes118

Files

1c7c7ae83e66ae45c5b34e3bfffa34d3_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

230f7393696796951a92a0be28c53813

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetNumberFormatA
GetProcAddress
GetModuleFileNameW
FlushInstructionCache
LoadLibraryExA
GetShortPathNameA
RtlUnwind
WaitNamedPipeW
GetTapeStatus

advapi32

FreeSid

oleaut32

SysFreeString

user32

wvsprintfA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
Kokgpak
DllMain
DllRegisterServer
DllUnregisterServer
ServiceMain

Sections

.none
Size: 97KB - Virtual size: 264KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.none2
Size: 512B - Virtual size: 490B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 224B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mnon
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_MEM_READ