5f3656b1396fa17252c834b5ae00bc50_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5f3656b1396fa17252c834b5ae00bc50_JaffaCakes118
Size

46KB
MD5

5f3656b1396fa17252c834b5ae00bc50
SHA1

3081d5891ec7c60a0e572d35cc81784149d3f6f4
SHA256

9da966588b7f5054466cc43c3b44063c732afc898308d240ea7626a228fee769
SHA512

32ef198d7a7b7939ad7f898f849f622d495a95a6e1aa274455873ede2f35c8f11a97ecf94814fb37baf6b89671beaaddc4e5d4d23e2b5ecb3869f6170acda842
SSDEEP

768:TS9MqQqESQhZGZJGWxNYNEtbxW3rUTALYz7AMbTmcvxiTGf3d0Kk2Q7KK:m9MqdESQhZExNYZ3r+vcMbtpOk0Kk2QJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5f3656b1396fa17252c834b5ae00bc50_JaffaCakes118

Files

5f3656b1396fa17252c834b5ae00bc50_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
JmpHookOn

Sections

CODE
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 400B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 202B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ