636d7e1512ad5513a8cd8f056e4c1487_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

636d7e1512ad5513a8cd8f056e4c1487_JaffaCakes118
Size

256KB
MD5

636d7e1512ad5513a8cd8f056e4c1487
SHA1

6397b815bf0a6bc0405644a4638974e88b5d61ed
SHA256

d480444ca6d7b9749313463f9fa712fc7636d57b6758ff83cd2059332beebebb
SHA512

13d43563fd28bca02a98d57fc6c32c259fecc42d099280b6e95d315d600ac27d5004970554fbf0744fd70d50d817ad59ac286a5cd9f90cc965ebdab1ee2bf743
SSDEEP

6144:5dV/3p9sKsRRdj2rc5I1s27jo+vKehIkUiiNLHUD:5dx5atSc2xxKeykUhLK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
636d7e1512ad5513a8cd8f056e4c1487_JaffaCakes118

Files

636d7e1512ad5513a8cd8f056e4c1487_JaffaCakes118
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

ConServerDllInitialization
UserServerDllInitialization
_UserSoundSentry
_UserTestTokenForInteractive

Sections

CODE
Size: 244KB - Virtual size: 244KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ