602f1201269dce02a2dcf3164dfef7c9_JaffaCakes118 | Triage

Sharing

General

Target

602f1201269dce02a2dcf3164dfef7c9_JaffaCakes118
Size

44KB
MD5

602f1201269dce02a2dcf3164dfef7c9
SHA1

f31de5f62991ac71caa4f9ee9339e016c679376c
SHA256

d5281d543ae427f7b2960b2f99e4a2c2ece25186fe9c0da8bc0119c0148ee75f
SHA512

a1db0a127f8bd5d03513eba2cf8c1eab35038347e72f19461f0a20cc94cdad7f5e2787e6e9d7f8dc4bf1369415b217a0ca16b0d3d397ad2aab8fc324959229f7
SSDEEP

384:ngUgzMT17YMsoUKrP9Uv3723DMsrV31JySnmgZyulgN995BH:iwT17YP49Uv3kD9Dxm8ypr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
602f1201269dce02a2dcf3164dfef7c9_JaffaCakes118

Files

602f1201269dce02a2dcf3164dfef7c9_JaffaCakes118
.dll windows:4 windows x86 arch:x86

48227d4f4f11b2c1a8ef34c49741c1f5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ord513
ord845
ord844
ord843
ord329
ord476
ord248
ord765
ord346
ord349
ord775
ord770
ord772
ord724
ord774
ord385
ord722
ord443
ord377
ord441
ord214
ord395
ord304
ord305
ord811
ord362
ord364
ord397
ord365
ord477
ord512
ord511
ord795
ord841
ord822
ord522
ord225
ord552
ord509
ord318
ord312
ord406
ord793
ord515
ord419
ord553
ord657
ord594
ord550
ord551
ord444
ord447
ord525
ord528

Exports

Exports

GetHeroAudio

Sections

.text
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ