38c374a4ca22eb658fb1c4549c12108e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

38c374a4ca22eb658fb1c4549c12108e_JaffaCakes118
Size

10KB
MD5

38c374a4ca22eb658fb1c4549c12108e
SHA1

c36a2dc7b48264b0bfcb256393770556dbece03d
SHA256

e1b2a995ff9d38bab0662cddf32e9160911f7a4a8b465f88ec62b8fd59bbce5d
SHA512

0f78f39c54b594c8f58fe47740a6d2bb83acb25b0678eb07060f30f18533d34d3dde9bdd8a65042b0b6a0eab6fa00e83216142033ca633a1d4642386488f5979
SSDEEP

192:WGgRL00vgnl38R7bG8Qq/nRtAvab8EM0Q+6oOfcFwRm2oSZ14:WrBy36HG8R+sQ+6tBaSZS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
38c374a4ca22eb658fb1c4549c12108e_JaffaCakes118

Files

38c374a4ca22eb658fb1c4549c12108e_JaffaCakes118
.dll windows:6 windows x86 arch:x86

b53f9c4bef393c316b46600c5cedde16

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

EnumResourceTypesA
EnumSystemCodePagesA
SetThreadExecutionState
VirtualProtect
GetNamedPipeHandleStateA

msi

ord131
ord170
ord74
ord59
ord77

crypt32

CryptMsgVerifyCountersignatureEncoded
CertAddEncodedCRLToStore

rtutils

TracePutsExA
TraceRegisterExW
TracePrintfExW

mscms

RegisterCMMA
UninstallColorProfileW
GetColorDirectoryW

Exports

Exports

Dkzsjxlz

Sections

.text
Size: 1024B - Virtual size: 674B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE