41a594873a7048dfbece66cd05e9311c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

41a594873a7048dfbece66cd05e9311c_JaffaCakes118
Size

961KB
MD5

41a594873a7048dfbece66cd05e9311c
SHA1

9e4695cff9adc33d9f94ef4ebee2cec865f87c5c
SHA256

800f421124cba69c9c9dc4ce9269e4deca49b6f85bc6c66be92a10d3d33c0b94
SHA512

d961f9efb744878e5a3b9167ca3e1f47cf4ada1a748ffed8737c817c29771242402af8f697b95bc52207a8a5f847dc9694704acc85bd3af59afcae8468ab0841
SSDEEP

12288:fyahVQ2vazku5M9fJo0K+XHU+U9oZKPP9K/b44SSydmZFXd932owTcogwx2eWK:fyqKEu5+5KXPlI44SRgZ9JwTpf2p

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
41a594873a7048dfbece66cd05e9311c_JaffaCakes118

Files

41a594873a7048dfbece66cd05e9311c_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

aadf5c8667fe05f652d8f2e502e2b9d7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

MessageBoxA

kernel32

GetModuleHandleA
GetProcAddress

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IAlloc
QueueMemory

Sections

.text
Size: 599KB - Virtual size: 599KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 273KB - Virtual size: 272KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 1024B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ