41c84f2eadfe8f44df36065fc545f236_JaffaCakes118 | Triage

Sharing

General

Target

41c84f2eadfe8f44df36065fc545f236_JaffaCakes118
Size

35KB
MD5

41c84f2eadfe8f44df36065fc545f236
SHA1

c500789ac1bdc81860f5131c170efa4781f90d28
SHA256

539d9d4ea7f9fc1c76fa3fd45e18f1ec6a1d5dc59fcc4858c8ee1e578448f9b8
SHA512

5a380689f76c014066c9b636e1c17289af6e26b7a777e245c544881e8a549dd1daea9cd8c48d19e79b409368453bb93097d0815bee3cc963315fb060e3a26bff
SSDEEP

768:dQoi6qZO1Qegd2GAPgxUf/6SYNmrcdVGkJ36ek:dQv6qZ4Q35Qg6f/6jP6p

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
41c84f2eadfe8f44df36065fc545f236_JaffaCakes118

Files

41c84f2eadfe8f44df36065fc545f236_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOf
JmpHookOn

Sections

CODE
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 201B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ