bf20d39d79130c848c5721217f287051_JaffaCakes118 | Triage

Sharing

General

Target

bf20d39d79130c848c5721217f287051_JaffaCakes118
Size

632KB
MD5

bf20d39d79130c848c5721217f287051
SHA1

4010c0e79fb9add1be30bcba56275d4a75ad850c
SHA256

41ab3fd24413f643ec46f485c53b484e83a30a96508b9a6ed37cbde885ea5b72
SHA512

7eca5781fe37686e0040f4638e4c1cb4cad96c9c02042ff96b606e8d0296ca540b82238062ae70d8f8ddd34040ea4b6a1d162b8f497e869bff7be02f7f5e2a7a
SSDEEP

12288:dChE5IWbf0U96zEu0SeoMB865tSU2xfZogEDfXKtow0G7BTyENNJzvV5vmursgUx:dh8mSeoMB865tSU2xfegEDaSkjsgUX1v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bf20d39d79130c848c5721217f287051_JaffaCakes118

Files

bf20d39d79130c848c5721217f287051_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

CODE
Size: 250KB - Virtual size: 250KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 449B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 182B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 168KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ