863a06154a7005295cb6e125983a6a2a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

863a06154a7005295cb6e125983a6a2a_JaffaCakes118
Size

30KB
MD5

863a06154a7005295cb6e125983a6a2a
SHA1

0cd6dc8f93d32b244d939af172f10b128d36d192
SHA256

1a061f97d02b6d4a9f4f7d72e153841a72e5c40cdcd8b548ac086346e280f05b
SHA512

5b829845e8fa294568473022ee1ffbf9f671f7e517ea5483d00d016a1603764bcebc82b860963549c8ae34544408eb873b9c983911ed6a1b245d92b302c0c219
SSDEEP

768:2Xk9BdiOskj34DxYgNKyYMzTuoo/JENCl3ZN:209BdxskLmYbyYMzTuJq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
863a06154a7005295cb6e125983a6a2a_JaffaCakes118

Files

863a06154a7005295cb6e125983a6a2a_JaffaCakes118
.dll windows:4 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Exports

Exports

Activate
DllCanUnloadNow
DllGetClassObject
HookProc
Logoff
Logon
Start

Sections

.text
Size: 14KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE