4154389813e1b6e277025e7196cd44d7_JaffaCakes118 | Triage

Sharing

General

Target

4154389813e1b6e277025e7196cd44d7_JaffaCakes118
Size

11KB
MD5

4154389813e1b6e277025e7196cd44d7
SHA1

5f39116db43b79106cb87722e18114a26c09e0d9
SHA256

1244c8266aa9212ea67aa45efc0fc6672250b418e7d3770a174a6de5fa79b98a
SHA512

28c77519b28d05ef7cafe8c6fb86800bc5f4bbd3df6a1d5b19f0923d801e3cb7691bd00f9f85b433e3a474ca119dcc57415586c39ab83f6a63a426012d4d80bd
SSDEEP

192:4Bff5QGymiCxUE97SDSIbrFApfrV0EGBwKy+rHBPQqJL+//RBMP:4pO2V9JXBVRKwKyUH2qNkR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4154389813e1b6e277025e7196cd44d7_JaffaCakes118

Files

4154389813e1b6e277025e7196cd44d7_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

55729cd5c9af9cce27d8c3b34c510aa5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenW
GetVersionExA
lstrlenA
MultiByteToWideChar
GetModuleFileNameA
GetSystemDirectoryW
CompareStringW
HeapAlloc
GetProcessHeap
HeapFree
Sleep
RtlUnwind
lstrcmpA
WinExec

user32

wsprintfW
CharLowerA
BeginPaint
ReleaseDC
ShowWindow
AnyPopup

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegSetValueExA

oleaut32

SysAllocString
SysFreeString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ