49d1057c038f4c82ec0f51aabc8357e0_JaffaCakes118 | Triage

Sharing

General

Target

49d1057c038f4c82ec0f51aabc8357e0_JaffaCakes118
Size

48KB
MD5

49d1057c038f4c82ec0f51aabc8357e0
SHA1

8d9ad651ec7af67a879bc1476d75a9c4198b7312
SHA256

78232c3807ef799ca0f7a86893e95317b96edfcf98975302e8b2482186b80ca1
SHA512

cdc7404b093ae3b5e1870484f5a670842fc1ea16c4d96ff9c6bb19317c7f0c2a61f15e5fe9ea2d32fceb9e3c4fd09d597d8aa6c0f727d50dbca81c6fd41eee96
SSDEEP

768:JmpM8V/VQ1GuorLW8B5uFiHCjMATi78rIhYSmpWk2VUbxOH3N/gAWR:Jaja6y8KiHCj/T0cWk2VUdWNCR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49d1057c038f4c82ec0f51aabc8357e0_JaffaCakes118

Files

49d1057c038f4c82ec0f51aabc8357e0_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
MgHookCs
MgHookOp

Sections

CODE
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 199B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ