a7f2fe5666e852c1eb85a98fb1338255_JaffaCakes118 | Triage

Sharing

General

Target

a7f2fe5666e852c1eb85a98fb1338255_JaffaCakes118
Size

243KB
MD5

a7f2fe5666e852c1eb85a98fb1338255
SHA1

1b169eb4f9fc04e7c91ae889d8157a0975ebda19
SHA256

97923ee1094e386286a3c23d63419cb76ff61f317fabb43b8d1afc66e880fd98
SHA512

69cdc891ce508fd43e81a0d6453230c03b2e89d48cfa7f78e5ca23d72be7d32f8cf5ebc5e241273bc2d19d7e1e931974ba1e4288bc977eb3292933347ae54020
SSDEEP

6144:NsFkpaDNNPdRMqUCW+STnzJwFBj+6UVVwolKZVPtJ:okpa7P6zqS6UVypZVP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a7f2fe5666e852c1eb85a98fb1338255_JaffaCakes118

Files

a7f2fe5666e852c1eb85a98fb1338255_JaffaCakes118
.dll windows:4 windows x86 arch:x86

76480ac538a58dcc5e1c585bfbac1659

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\knox-457\kernel\pluggo-win\pluggo_win_release\pluggo.pdb

Imports

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
GetProcessHeap
HeapFree
HeapAlloc
GetModuleHandleA
SetEnvironmentVariableA
LocalAlloc
GetProcAddress
FreeLibrary
InterlockedExchange
GetLastError
LoadLibraryA
RaiseException

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA

Exports

Exports

main

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 238KB - Virtual size: 238KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ