2556d56441a1ce5585f3ff1def492b7f_JaffaCakes118 | Triage

Sharing

General

Target

2556d56441a1ce5585f3ff1def492b7f_JaffaCakes118
Size

51KB
MD5

2556d56441a1ce5585f3ff1def492b7f
SHA1

cf2a2ba20266bd1dc209aa6ed958d2b55b392882
SHA256

3746cc246da5ed8605bf5f63123070291c57d7dc2d0429589fd5626adf1b5f13
SHA512

87f09e0f18c7127f73492059e1ca104be9c1095cbe88f471ec672ee3f9de74d6434cdc66bb6541eb88a3eed6d934340058ebd594ea1da72f73d4a17e16aa7437
SSDEEP

768:thasQNdywdL+c7eeWO5da6wSc37YfjCCxuzCCUBNYS/gYQXVTf612aeJS661Cwbc:fNToLBT5da57Yfbx2SulT9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2556d56441a1ce5585f3ff1def492b7f_JaffaCakes118

Files

2556d56441a1ce5585f3ff1def492b7f_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

3a9c5393aec647d2799a080dd4b62b50

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

gdi32

GetPixel

wsock32

WSACleanup

wininet

InternetReadFile

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JumpHookOff
JumpHookOn

Sections

CODE
Size: 45KB - Virtual size: 132KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE