76b392b94be0d6505f38357ef6a3b9a3_JaffaCakes118 | Triage

Sharing

General

Target

76b392b94be0d6505f38357ef6a3b9a3_JaffaCakes118
Size

23KB
MD5

76b392b94be0d6505f38357ef6a3b9a3
SHA1

2d1e790792e94abadbc39f8e517c9fb411957af6
SHA256

886b28122e24b1df2229d38f0d16be6f06891578d672eff6e6de7dc63a3d5a19
SHA512

7b0cdd14e8fd6707947c5560150fe2bb7b6ad6f3c71e3a774cdd3308cc50dd8c6e242222cfc53e8b47a08d79f0425500bd8c3b645cdea9988c1963c1d4953791
SSDEEP

384:pDyDyq5LS8tPMxdyImSjfckjcKM8G7wlFU3xmH3YI+Ejz7uMuGlPRNAa6aAWD8DB:lIJymsOKM8BnUYz7vn6ashL3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
76b392b94be0d6505f38357ef6a3b9a3_JaffaCakes118

Files

76b392b94be0d6505f38357ef6a3b9a3_JaffaCakes118
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

StartHook
StopHook
pt_ksHook
pt_tzHook

Sections

CODE
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 129B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ