35b445417f6fa1cfe78ce42a07ef5335_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

35b445417f6fa1cfe78ce42a07ef5335_JaffaCakes118
Size

505KB
MD5

35b445417f6fa1cfe78ce42a07ef5335
SHA1

da846061891d60273d34d09faaa6dbbb30f996cc
SHA256

0e1020bff9422239235e2a1344843d31ca6669fc366372f292a99c841ecb0f3b
SHA512

3327fd48c53e7a99879efc34e564cccd5639f96d435dc956364811a1a09fdbcd911bbb0605317027ea5a579abf956399b0ae9b5f253c4fb598185561e0337f90
SSDEEP

12288:qgkBuHsZfYLyB9SqoKumDXh1al+hte5+tAL7LwOJ50UWpGtJxK:zHnqoKpXLaUygKPwob

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
35b445417f6fa1cfe78ce42a07ef5335_JaffaCakes118

Files

35b445417f6fa1cfe78ce42a07ef5335_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

0021f47781268b6caaf314d0b686997c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

Imports

kernel32

ExitProcess
FreeLibrary
GetModuleHandleW
GetVersionExW
lstrcmpiA
GetProcAddress
DeleteFileA
VirtualProtect
GetCurrentProcess
GetCurrentThreadId
GetTickCount
lstrcpyW
lstrlenW

user32

wsprintfW

Exports

Exports

CPlApplet
DllCanUnloadNow
DllGetClassObject
DllGetClassObjectEx
DllRegisterServer
DllRegisterServerEx
DllUnregisterServer
DllUnregisterServerEx

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 326B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.stub
Size: 496KB - Virtual size: 496KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE