2518d01a6a1fa6a30f8e879883266e67_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2518d01a6a1fa6a30f8e879883266e67_JaffaCakes118
Size

252KB
MD5

2518d01a6a1fa6a30f8e879883266e67
SHA1

2fd520775e053e2fb09b1b4134aaff3f15f74967
SHA256

ff743fdee1cd7923d2911b0368a0ba0a6e2d54d94873c787b7b17f161d75c87c
SHA512

1637ce7e00cf90da33c1d58fac08bacaa71bd2a967f1b7e030dcd07373723eed6eaed63d092a160b72dbbe639f18dc6a41ed1592c35be833db7b489212c291fa
SSDEEP

3072:KLs0sEYimSpX4zu5JNYU9hpePGA1zpDOz:+/7mSSzE/Yohpmwz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2518d01a6a1fa6a30f8e879883266e67_JaffaCakes118

Files

2518d01a6a1fa6a30f8e879883266e67_JaffaCakes118
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\csrg_production_ver2\51162a39\4fb8fc9f\App_Web_4pmzj-ab.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 228KB - Virtual size: 225KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 4KB - Virtual size: 182B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ