28405700229dc919f6bce2f1f35a4cf6_JaffaCakes118 | Triage

Sharing

General

Target

28405700229dc919f6bce2f1f35a4cf6_JaffaCakes118
Size

17KB
MD5

28405700229dc919f6bce2f1f35a4cf6
SHA1

c536ec2a90b1082b6ad0109856eaf17cd0f082e6
SHA256

93a0f09d6cd33eee5b81f15b91ecdc18aba9d0f2873c0fcec4843adf66301777
SHA512

57217748bfbd19bf926576a0bb9c6a06cc6413b51ac250d164d6b34ccbe7a54f10f3774993ed31c5f215f2433d7152feb88bd26d6048a940b5ae857983160178
SSDEEP

384:GiHkXw+saVknOktpRe+LreQDhiehGxuUJh2hCA:tEXw+juOkT0+LrNwqGcUJshn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28405700229dc919f6bce2f1f35a4cf6_JaffaCakes118

Files

28405700229dc919f6bce2f1f35a4cf6_JaffaCakes118
.dll windows:6 windows x64 arch:x64

1a2927e01a0b2a01d537099e27c75534

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_ismbbgraph
_mbsspnp
memset
__iscsym
wcscspn

advapi32

CryptDeriveKey

ole32

CoUninitialize

crypt32

CertGetCertificateChain

kernel32

GetModuleHandleW
SetFileAttributesW
IsDebuggerPresent
IsProcessorFeaturePresent
FileTimeToLocalFileTime
SetHandleInformation
TransactNamedPipe
CreateProcessW
GetProcAddress
GlobalAlloc
VirtualProtect
HeapUnlock
SuspendThread

Exports

Exports

payload

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ