b59c6d31b16236876e198c1afa4df0f4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b59c6d31b16236876e198c1afa4df0f4_JaffaCakes118
Size

119KB
MD5

b59c6d31b16236876e198c1afa4df0f4
SHA1

a6c863ac9ba25730f7e4a1b4bb1fabafd434886c
SHA256

f86a3b6b59feecc0a0d7265caad3eb63467fc85ec378dd7b181a82f6f194fff1
SHA512

9b92764824f0111d33bfc421ecfa442e726b623c17d318a90c31531f1bd5b1fde74f77ccd99a4ca23c4af8483fc3cf43bb10435f189870a5329ccd2d7bb11fa6
SSDEEP

3072:Xirgw6a8wo5ZZTkqbJ1708irk5i1nSN8:XirgV1LQqbBiVg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b59c6d31b16236876e198c1afa4df0f4_JaffaCakes118

Files

b59c6d31b16236876e198c1afa4df0f4_JaffaCakes118
.dll windows:4 windows x86 arch:x86

8b27d17746d2b1b7a93168398212fcd6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetProcAddress
LoadLibraryA

advapi32

FreeSid

oleaut32

SysFreeString

user32

CharNextA

version

VerQueryValueA

wsock32

send

Exports

Exports

DLLCanUnloadNow
DLLGetClassObject
DLLRegisterServer
DLLUnregisterServer

Sections

.text
Size: 117KB - Virtual size: 292KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE