aafc82c4547a24bdc15ea6df5e7782e1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

aafc82c4547a24bdc15ea6df5e7782e1_JaffaCakes118
Size

550KB
MD5

aafc82c4547a24bdc15ea6df5e7782e1
SHA1

81a2f81a20ad788c25f7957288428513394b21ff
SHA256

e484d43c623fdeaf1bdf096da3ab4a74d45cb0171c6ccd633fa046de71df0cec
SHA512

ba7c9b6761479efd5824d8a87a41130337316547e24dab6f84359d22692a85fbb4ae25806a1640613e316b1c43751a857d952bf454446528c1a471b3a8d9a011
SSDEEP

12288:cTNuN784Dy5IC+J1Walb/PKbS6r+QPm7u:kNuKkC+H51HL7u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aafc82c4547a24bdc15ea6df5e7782e1_JaffaCakes118

Files

aafc82c4547a24bdc15ea6df5e7782e1_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

aeed9b6a1a6064a049ec86d8b240e289

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegQueryValueExA

user32

GetKeyboardType

gdi32

UnrealizeObject

version

VerQueryValueA

ole32

IsEqualGUID

comctl32

_TrackMouseEvent

wininet

InternetSetOptionA

shell32

ShellExecuteA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 533KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE