39c7501c4d461444a9439a35e3a1af05_JaffaCakes118 | Triage

Sharing

General

Target

39c7501c4d461444a9439a35e3a1af05_JaffaCakes118
Size

24KB
MD5

39c7501c4d461444a9439a35e3a1af05
SHA1

60b2c46356ed66dcf76218a3005282a3adf5246c
SHA256

32b00bd8589b896fead29c846e1ed4ab9588099fd4be4ad47c9d52740fb0ed7b
SHA512

677a09cfcd6379cabd818c9cbe7278f74705d13698a3280c02d4b9d4f37905175e3627cab0c0dee1f02eac14d328b28ceb52e6956a561f4454b622c4b851951a
SSDEEP

96:OpGibuEBbAKf/QhnRyAvrRpoTc7f9MnCrROLoyC/YKuB:OAWL/QhnRyAvrRpz7FZROcc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
39c7501c4d461444a9439a35e3a1af05_JaffaCakes118

Files

39c7501c4d461444a9439a35e3a1af05_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

44ad620e664f8f3618b37fbf3306611b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

SHGetValueA

kernel32

GetProcAddress
GetProcessHeap
LoadLibraryA
CreateDirectoryA
GetEnvironmentVariableA
FreeLibrary
DisableThreadLibraryCalls
HeapAlloc

user32

wvsprintfA

Exports

Exports

CPlApplet
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
SecurityMonitor
ShowSecurityDialog

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE