a393df2af4708ff2592687ff4ee343b9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a393df2af4708ff2592687ff4ee343b9_JaffaCakes118
Size

18KB
MD5

a393df2af4708ff2592687ff4ee343b9
SHA1

19b5212fc5dbd673f7e4f78c52b6c0ea33121d85
SHA256

eea2ac27c7db126176b9cbf245328c9acb06665995f1212cc28792304ca3f6f5
SHA512

b960e1ad593a17d94cacec2ef4e30c1b17b69469e3f1a0b26d992dce1ef697078a466bd1bde5779373bae6ff5b35c39a13f818c03c4a3a3eacda051b44ea0491
SSDEEP

384:WkZm9ZV/dm0q96GA2P0ICNPBRJyCmyCtQV2djVh2:WkZaZVd/qSkQHDlV2djV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a393df2af4708ff2592687ff4ee343b9_JaffaCakes118

Files

a393df2af4708ff2592687ff4ee343b9_JaffaCakes118
.dll windows:6 windows x86 arch:x86

b53f9c4bef393c316b46600c5cedde16

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

EnumResourceTypesA
EnumSystemCodePagesA
SetThreadExecutionState
VirtualProtect
GetNamedPipeHandleStateA

msi

ord131
ord170
ord74
ord59
ord77

crypt32

CryptMsgVerifyCountersignatureEncoded
CertAddEncodedCRLToStore

rtutils

TracePutsExA
TraceRegisterExW
TracePrintfExW

mscms

RegisterCMMA
UninstallColorProfileW
GetColorDirectoryW

Exports

Exports

Dkzsjxlz

Sections

.text
Size: 1024B - Virtual size: 610B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE