49db0ca0404f5a54dfa0870eee7d0819_JaffaCakes118 | Triage

Sharing

General

Target

49db0ca0404f5a54dfa0870eee7d0819_JaffaCakes118
Size

60KB
MD5

49db0ca0404f5a54dfa0870eee7d0819
SHA1

1ace3ee0a6f6314e1489c3e778615b174a7db4ca
SHA256

d9d6d4fe58a6302d9ca22afc440cbd7b012465a867bb98d041c7e31b20043ddf
SHA512

8c0b92a1e9ab3d7fc51659825e7e7068bdf5b8c08dbab9f84ef3735f364f248a81ac346e5f64335e8cf163f88007074a2d458fb3c0cc24a23bfacaf3e910ac22
SSDEEP

768:XjCnAq2rFszzVjT95N31+24VptXJo2PzC7i/Mp8Lt2dso+xu/puBcGUcELFNapuX:WAq2rFsnDGVptdC7GM+Ltms7epETotx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49db0ca0404f5a54dfa0870eee7d0819_JaffaCakes118

Files

49db0ca0404f5a54dfa0870eee7d0819_JaffaCakes118
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

InstallALLHook

Sections

CODE
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 75B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ