aff45edf267109e3f181d8c18e7cba7e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

aff45edf267109e3f181d8c18e7cba7e_JaffaCakes118
Size

76KB
MD5

aff45edf267109e3f181d8c18e7cba7e
SHA1

bbcd49c16fd793ae54c00d1fdf003743610e4460
SHA256

14926da08939e78f0bee2d5339ab41b0951e2d9b585601c92c62abe1429a9603
SHA512

7e7855638708e49e9684f8b2303c861276879fa666a6931d11b217943c57cf54d3cf9b4e2ba875d3178e30d78e45424ce77f546670cd751ff6c80165593552d0
SSDEEP

1536:asu7+Lro3kIkeKtUKrSzbqlkg79IfsI0:as8+o0IkdjW/gI0I0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aff45edf267109e3f181d8c18e7cba7e_JaffaCakes118

Files

aff45edf267109e3f181d8c18e7cba7e_JaffaCakes118
.dll windows:4 windows x86 arch:x86

266d22626c7b7aa476a3711caffd15fa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ExitProcess
Beep
ExitThread
HeapAlloc
GetProcessHeap
HeapFree
EnumCalendarInfoExA
GetDevicePowerState
SetEndOfFile
CreateFileA

rpcrt4

RpcStringBindingParseW
RpcBindingVectorFree
RpcBindingToStringBindingW
RpcEpUnregister
RpcEpRegisterW
RpcServerListen
RpcServerRegisterIfEx
RpcServerRegisterAuthInfoW
RpcServerInqDefaultPrincNameW
RpcImpersonateClient
RpcRevertToSelfEx
UuidFromStringW
NdrAsyncServerCall
NdrServerCall2
RpcStringFreeW
RpcServerInqBindings
RpcServerUseProtseqW
RpcAsyncCompleteCall
UuidCreate
UuidToStringW
RpcMgmtStopServerListening
RpcAsyncAbortCall

Exports

Exports

jlyhqw

Sections

.text
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ