9539ffa32debb19364c540a6c66954ce_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9539ffa32debb19364c540a6c66954ce_JaffaCakes118
Size

72KB
MD5

9539ffa32debb19364c540a6c66954ce
SHA1

98f626f4fbb69cfd6e74d0216313b40888dbc88e
SHA256

61019a6ab1fb2480aeef810df2b2c7e362551298c79e1dc593c9edba50e9aaea
SHA512

bb7b5c01785dbb11892d9c2afa59cf94afa42f8a16d4cf8ee69d7f9fc4d1669e29e85f27c430b443a84a8f495885f006589604bbfe9e3487c812082dcd6b163a
SSDEEP

1536:z6bt5EtCevkwIePo3Ox94kvpMX1eYn6DSSP:z6bbENM4x94kRMleYn6n

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9539ffa32debb19364c540a6c66954ce_JaffaCakes118

Files

9539ffa32debb19364c540a6c66954ce_JaffaCakes118
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Users\Yo\AppData\Local\Temp\Temporary ASP.NET Files\pharma.v1.23b\121316a6\e639f2bf\App_Web_hjfw4_l6.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ