645fc20bfeb3021f66fe3fd9734741b3_JaffaCakes118 | Triage

Sharing

General

Target

645fc20bfeb3021f66fe3fd9734741b3_JaffaCakes118
Size

125KB
MD5

645fc20bfeb3021f66fe3fd9734741b3
SHA1

47fc4510c3d925cad5dcc42e5d546162c1401537
SHA256

f1ae1489cdc9b6f50226130907579329c81ba0eb6147a3302f58688cd5950e5f
SHA512

5996396d0ff5316092472a6a47d4aaff1774c8bdf734ab584db4d7f9179f40ae2895ab824c7ceaa57a5dfa924cefbaa7f749a12e9f32a7f04dcee881973b4654
SSDEEP

1536:rYOJyVrfHL1uk8bsMciJjWwu5elHFKqOxRAGq8H1t6JjunRUsJ+5lVEQnXeX:rYTVb8lc0WwzlHFa1q8H1s1unrck2uX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
645fc20bfeb3021f66fe3fd9734741b3_JaffaCakes118

Files

645fc20bfeb3021f66fe3fd9734741b3_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

fdbfec85672f73d2a4d49635454936d4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetProcAddress
GetModuleHandleA
LoadLibraryA
ExitProcess

user32

MessageBoxA

Exports

Exports

DisableHook
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
EnableHook

Sections

.text
Size: 1KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 82KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.perplex
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ