681d12abf790003d1bb7b295374a57c2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

681d12abf790003d1bb7b295374a57c2_JaffaCakes118
Size

59KB
MD5

681d12abf790003d1bb7b295374a57c2
SHA1

037fcbdadffd5619c5cd815ee2caacd86c0d0f2d
SHA256

764b77eae32a5e6228f4a82563812732663dff5afe5689a75f08882dae06a413
SHA512

2afe6b5c5e2fc54976f5db91e8a7f2606c897ce11a2357f20ce8765022bfdcb330500fa77b7526156b3ea07123d2dfce70521cae7ddc13f136f5f643b401ffc6
SSDEEP

1536:rxnZBNNs1ejJUiWApv316OQuLjTOYvU9YCi1PBH:bBNNssjJ7WU/9QuL/8yL1ZH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
681d12abf790003d1bb7b295374a57c2_JaffaCakes118

Files

681d12abf790003d1bb7b295374a57c2_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

80fe09be11839b788b6967f33f928732

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

CharNextA

advapi32

RegQueryValueExA

shell32

SHGetFileInfoA

ole32

StringFromGUID2

oleaut32

SysFreeString

shlwapi

PathFindExtensionA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 39KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE