a98182ea3f68c458a5400727fbbbca70_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a98182ea3f68c458a5400727fbbbca70_JaffaCakes118
Size

51KB
MD5

a98182ea3f68c458a5400727fbbbca70
SHA1

dec85446994a84db46dfffd0910beb817198a57d
SHA256

92564385a459595cfc14b75b4e26dce4f69845301af16aebc80dec6ea5b62635
SHA512

0478f6290af079c1bc791aa9d43e987bab13500130e61c67e5ac37cd89c395cbf197c570a95da5cf0d871322e144cdf706251860c783a690085fe002c552c8ac
SSDEEP

768:h7y0y5D77bJr4bTo2nYLlnyImFwVDHDQK4zGR8pHhHw4UdM8gn:h7y0y1LJr+nYJn2UoK7R8VhH0g

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a98182ea3f68c458a5400727fbbbca70_JaffaCakes118

Files

a98182ea3f68c458a5400727fbbbca70_JaffaCakes118
.dll windows:4 windows x86 arch:x86

9fe8ad4136c704ba730ca7849fb2c993

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ald.pdb

Imports

kernel32

Beep
HeapReAlloc
HeapDestroy
OpenEventW
FindResourceExW
FindResourceW
SetLastError
HeapAlloc
GetProcessHeap
HeapFree
LoadLibraryW
LoadLibraryA

rpcrt4

RpcStringBindingParseW
RpcBindingVectorFree
RpcBindingToStringBindingW
RpcEpUnregister
RpcEpRegisterW
RpcServerListen
RpcServerRegisterIfEx
RpcServerRegisterAuthInfoW
RpcServerInqDefaultPrincNameW
RpcImpersonateClient
UuidCreate
UuidToStringW
RpcMgmtStopServerListening
RpcAsyncAbortCall

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 418B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ