2bd86a28af7e0c1a0112c9a301091492_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2bd86a28af7e0c1a0112c9a301091492_JaffaCakes118
Size

148KB
MD5

2bd86a28af7e0c1a0112c9a301091492
SHA1

e198b74337ea583101669b96bc9b0cd9dd5343b9
SHA256

ad323b8373020f0f77fbeab079b885ac452af7a8f7b37f8443366781821c0844
SHA512

1f10ff018986f4e1b96ea41d604dfa0ce249c99a070d832a14d11b1ac6f13c0ce3c20c5af806f81dc3aae7229e75aacfccc7fa3888d769067672067d46715b0b
SSDEEP

3072:7wtGxfg31qXIW0k7VoWE3JWlDTPOCDgn+AfM9pTBfR/rK:iGxzXf2q3c+Ak9pTBJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2bd86a28af7e0c1a0112c9a301091492_JaffaCakes118

Files

2bd86a28af7e0c1a0112c9a301091492_JaffaCakes118
.dll windows:4 windows x86 arch:x86

77039296ad5c841987927924af51993d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

picn20

PegasusUnload@8
_PicOp32@8
PegasusLoadFromRes@16

kernel32

GetProcessHeap
HeapReAlloc
HeapFree
HeapAlloc

Exports

Exports

_Pegasus@8

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ