331bd63697ed3341f81ada847ffcf83c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

331bd63697ed3341f81ada847ffcf83c_JaffaCakes118
Size

118KB
MD5

331bd63697ed3341f81ada847ffcf83c
SHA1

fe529f607da2ae67bbd2c11582d1bd1a388d9c1c
SHA256

eb4616014a56937b4e1d50351b121e39588d054e6e1d0013d4f83942cb134242
SHA512

1aeceb8ac77f8232b7c89a7d44741e3672536e102a4882fb494d554c32eeba6315326fabe318a121e500a0fa16d98319dc917eb457e57efbab78eea9d0c413ce
SSDEEP

3072:R+IV+6ndnZDSeDeT5VbJLKeITdNASuYQs:kIVBDSeyLbBITdN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
331bd63697ed3341f81ada847ffcf83c_JaffaCakes118

Files

331bd63697ed3341f81ada847ffcf83c_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

ed9374cfc13f0ca6f73a60524bb6a49f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetSystemWindowsDirectoryW
GetProcAddress
SetLocaleInfoA
LoadLibraryExA
HeapSummary
FlushConsoleInputBuffer
CreateJobObjectW

advapi32

FreeSid

oleaut32

SysFreeString

user32

CharNextA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
Bkibkib
DllMain
DllRegisterServer
DllUnregisterServer
ServiceMain

Sections

.text
Size: 114KB - Virtual size: 292KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 224B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_MEM_READ