6f0b8320e42611acf6d8dfbbcc328844_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6f0b8320e42611acf6d8dfbbcc328844_JaffaCakes118
Size

478KB
MD5

6f0b8320e42611acf6d8dfbbcc328844
SHA1

362b0fe818fc2c7df87e550c3fc434b87875d330
SHA256

fe75d5af651b3eb0b588bc688fbf8dc6c693266b2407a0e6d86dec10a19f3210
SHA512

6ea80828771f1e71d512a63979f751a8eae716ae476d5a67ed5fbc462547bcbf31ccc3e4b725534ba6fbf03e9be536dcb725628efcf390a7279dcdeedc7d1e7a
SSDEEP

12288:ZYYBz36l4Mat9cG9LORaJRe8g817z50aagVnFbvEZzVuJXQTriyI2uPU:ZYYF2aDNe8g817F06VnFw5kWTriyF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6f0b8320e42611acf6d8dfbbcc328844_JaffaCakes118

Files

6f0b8320e42611acf6d8dfbbcc328844_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

aadf5c8667fe05f652d8f2e502e2b9d7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

MessageBoxA

kernel32

GetModuleHandleA
GetProcAddress

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 350KB - Virtual size: 349KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ