b80a6d9a095d190a4f56007c3f17cdae_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b80a6d9a095d190a4f56007c3f17cdae_JaffaCakes118
Size

9KB
MD5

b80a6d9a095d190a4f56007c3f17cdae
SHA1

2ac259ce20384a5bad608434bd824443b24d04b4
SHA256

e4897fe2172e28dca05372bdffde19830ab814393202035344367520dc7c76ed
SHA512

1639cf845207aa7f0baad59fa0db3c76389da0909323753e33fa833d80461d8a92bdf8cf70b8baae3d376baa3ba9895a7a7ff2d7b9bf9f1bc5ab4bd1c12c3965
SSDEEP

96:LbYmVv7I0s3331rPfU4jozoglPiGe+gcoA1gvSFsdh6BanEynjPzufFB:Lbj3CTs4czdiGX6AOvOsdh4an/jPzuv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b80a6d9a095d190a4f56007c3f17cdae_JaffaCakes118

Files

b80a6d9a095d190a4f56007c3f17cdae_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

5aa9600270c7a740566a98f13d6e4e13

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

UnhookWindowsHookEx

advapi32

RegQueryValueExA

wininet

InternetGetConnectedState

urlmon

URLDownloadToFileA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 2KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE