b667930db2ff6ab0e13d59f7774769a5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b667930db2ff6ab0e13d59f7774769a5_JaffaCakes118
Size

82KB
MD5

b667930db2ff6ab0e13d59f7774769a5
SHA1

0a705faf41bdac7a3fe83c8e1d8514c851b9157d
SHA256

fd85e9c9bd2288672a75f0c1d8a6e7a074e47098089d53d3ba6275f023499c7f
SHA512

fbb4c4d72f6dc39d5a2e0a843a996ab3147a4721555f8e84e76aedf6f1d54b99b7887c18992176afdde55a5b341031e812f14008d5fdbe890bba47f2d2351ba3
SSDEEP

1536:6NPQdLpG3394UagHveKdaCOWPW/ZGo9sZeHv1qylzsAF2V+:6oG33uUaLaaC7MpKhysAY4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b667930db2ff6ab0e13d59f7774769a5_JaffaCakes118

Files

b667930db2ff6ab0e13d59f7774769a5_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

9ee1cba00cc5292a9e2bd975512b3217

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryExA
GetProcAddress
LeaveCriticalSection

advapi32

FreeSid

oleaut32

SysFreeString

user32

CharNextA

version

VerQueryValueA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
Mondmon
DllMain
DllRegisterServer
DllUnload
DllUnregisterServer
ServiceMain

Sections

.text
Size: 80KB - Virtual size: 196KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE