2816781a71e6c16044ee9e4146dbac30_JaffaCakes118 | Triage

Sharing

General

Target

2816781a71e6c16044ee9e4146dbac30_JaffaCakes118
Size

75KB
MD5

2816781a71e6c16044ee9e4146dbac30
SHA1

5f309f45a599bb41c3c8af163358438ff87c7121
SHA256

27225ac38afeac75aaf1fdcb87b675d0ad63d28407532f1b14329cd2fa3f6ef7
SHA512

ec170565b59632aa7009c26b7a59adbd0cecc09de3ada561a1633ef1d154c0c012950a7fc5189b4803e9c4b9ca723d66be6797aef86964fd1739f1a3629fddb3
SSDEEP

1536:36wdzdZsrWtMaqs3NS8+8iQhGAMUF1EoEhE9wjZK:36mpZsrWtrqCfiQhGAHF1EoEhE94Z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2816781a71e6c16044ee9e4146dbac30_JaffaCakes118

Files

2816781a71e6c16044ee9e4146dbac30_JaffaCakes118
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\ghloan\e278d612\4c19d742\App_Web_n3wdhxri.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 170B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ