4de1094b0c79ed6707bb92d3ce0bd3ed_JaffaCakes118 | Triage

Sharing

General

Target

4de1094b0c79ed6707bb92d3ce0bd3ed_JaffaCakes118
Size

792KB
MD5

4de1094b0c79ed6707bb92d3ce0bd3ed
SHA1

4e9c78f8aa431550a2c30ee75820f82a9d8a2e69
SHA256

c2218af6a7a7b4ebe738ed7292e0da9ddcf6b9095a26e3dcab9800eff9b65d14
SHA512

55d86ebefb4d47fb2aab0f124f2b756db130c9f13f11dace0ecf8f9753601deb64e4dc4ea950c6257214c5ea24678d2c4c9b154ac898f030205227dec19beecb
SSDEEP

24576:rCG7Nv4lwTZHLTj3HqOZEJtKfJZW9Qr1UPop:r17Slw1H3O39Qmw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4de1094b0c79ed6707bb92d3ce0bd3ed_JaffaCakes118

Files

4de1094b0c79ed6707bb92d3ce0bd3ed_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

22e429ea05a1aa0d15dbe39a751dd746

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

mpr

WNetGetConnectionA

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

IsEqualGUID

shell32

ShellExecuteA

comctl32

ImageList_SetIconSize

urlmon

URLDownloadToFileW

comdlg32

GetOpenFileNameA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Gbieh
SpecialFunction
build

Sections

CODE
Size: 778KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE