bb17df1bdf7347c5359bea0e088d24a8_JaffaCakes118 | Triage

Sharing

General

Target

bb17df1bdf7347c5359bea0e088d24a8_JaffaCakes118
Size

356KB
MD5

bb17df1bdf7347c5359bea0e088d24a8
SHA1

42505adc5d018b829067c4e5547662b617fe2f32
SHA256

fba45a51871e04ec73126b0e0080c4c6ddb9202e21baa793db952477cb609f1c
SHA512

b2f7812a7af982a249f52f81edf9f4bc2900d64b77755023ba6c6fcd1df28b489a404fe990c6d55d843136c8a322faea3159f3f0bfaeb25a89d012ac5b12b70a
SSDEEP

6144:uEu7yd7EIq5gEzNZl2c/wxeoJPTVZRcece6d45Qu9/JKZytPEe7BktCJp:P4c4x59ZZlBLoBYN4OWKZYPEQBQCL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bb17df1bdf7347c5359bea0e088d24a8_JaffaCakes118

Files

bb17df1bdf7347c5359bea0e088d24a8_JaffaCakes118
.dll windows:4 windows x86 arch:x86

9fe8ad4136c704ba730ca7849fb2c993

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ald.pdb

Imports

kernel32

Beep
HeapReAlloc
HeapDestroy
OpenEventW
FindResourceExW
FindResourceW
SetLastError
HeapAlloc
GetProcessHeap
HeapFree
LoadLibraryW
LoadLibraryA

rpcrt4

RpcStringBindingParseW
RpcBindingVectorFree
RpcBindingToStringBindingW
RpcEpUnregister
RpcEpRegisterW
RpcServerListen
RpcServerRegisterIfEx
RpcServerRegisterAuthInfoW
RpcServerInqDefaultPrincNameW
RpcImpersonateClient
UuidCreate
UuidToStringW
RpcMgmtStopServerListening
RpcAsyncAbortCall

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 318KB - Virtual size: 317KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ