b0e222191b2730259cb76fd66594c76e_JaffaCakes118 | Triage

Sharing

General

Target

b0e222191b2730259cb76fd66594c76e_JaffaCakes118
Size

93KB
MD5

b0e222191b2730259cb76fd66594c76e
SHA1

fabc2bba4220ec4882e95af610782b1206463d21
SHA256

db1fc7a1ec4532d1799fe41c10c105b3c4e8f557966cdf0733ce43f427fd8177
SHA512

e8051fce0fab504a230e6aeec1d3fdeb69556badd006e7300b4707fc56f01de10b2bb43b8fce6b272bd111186ac7b27d8b1a558f965bdf2d41b739ab3c3a298f
SSDEEP

1536:4ze9phldmgr6F3+2MFzgzAB/yqPnXLDpaj14TuhQ0HqOKbF5Mk/X:ge9p7dJv3zzfhax6uacqpL/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b0e222191b2730259cb76fd66594c76e_JaffaCakes118

Files

b0e222191b2730259cb76fd66594c76e_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

053fa25ca4d550a16d47a300262f1454

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

gdi32

SelectObject

wininet

InternetReadFile

oleaut32

SafeArrayPtrOfIndex

wsock32

WSACleanup

advapi32

OpenProcessToken

user32

GetKeyboardType

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JumpHookOff
JumpHookOn

Sections

CODE
Size: 86KB - Virtual size: 208KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE