3295ebd7054db9a46c9a36fe948d2409_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3295ebd7054db9a46c9a36fe948d2409_JaffaCakes118
Size

184KB
MD5

3295ebd7054db9a46c9a36fe948d2409
SHA1

897675a341e6071048eb8737cd26a200beaa8754
SHA256

86e243f08b02c19e7ca06a88e668d1074bfd9636152a970bc0e6d70aa20e6560
SHA512

cc86a0c24e62da501d032be1e24e15fbdd77c323cc619be9a32bc39bf22db18daf95edbf7c6f6dd01ac0025686245e4ae7e259fae883c5020ed5a25f8c947e6d
SSDEEP

3072:q84n6/bvlNZZBQ55foJECGGeKGVWkYz/T8/SPna2LBFA9ernsinA/v3s/8lu7uUo:q848/7iCG/RY7pa2LBFAniC2Jw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3295ebd7054db9a46c9a36fe948d2409_JaffaCakes118

Files

3295ebd7054db9a46c9a36fe948d2409_JaffaCakes118
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\root\da320a10\f1e6e047\App_Code.tfrs-udd.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 181KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 169B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ