8c079437ac32aa0a3ec931649262c9d6_JaffaCakes118 | Triage

Sharing

General

Target

8c079437ac32aa0a3ec931649262c9d6_JaffaCakes118
Size

482KB
MD5

8c079437ac32aa0a3ec931649262c9d6
SHA1

d6be56c563e34ecac1b9ba0c011e92dfc5788c21
SHA256

8840edbf4c731c139ec50f72a2888cc6a952fe745038d4ab38a22258628ad3e7
SHA512

22d3b84b8b6298ab46db0a064fcfba43839d39caa5bb49ca1b84c807c2b2220d73a366d9abb5e3036b1a14661ca3eafd9548d58519a05c15c6cc4b667c5e4d18
SSDEEP

12288:3YfbsxpdrCGmA0Lh1C/KDMnb8WCfCdXAyF0Hz9hbn:3YzsbdVQh0/KJB+Qy6pd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8c079437ac32aa0a3ec931649262c9d6_JaffaCakes118

Files

8c079437ac32aa0a3ec931649262c9d6_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

b833c8b9ef7c8f69ef4384881250a465

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

mpr

WNetGetConnectionA

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

CreateStreamOnHGlobal

comctl32

ImageList_SetIconSize

wininet

InternetGetConnectedState

urlmon

URLDownloadToFileA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

CODE
Size: 470KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE