c8d31064ea3229cd4344519cf29df1c6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c8d31064ea3229cd4344519cf29df1c6_JaffaCakes118
Size

959KB
MD5

c8d31064ea3229cd4344519cf29df1c6
SHA1

6829cf835aabed5a6e9f233fbd0c8055e6428737
SHA256

3d2b4985dc29b40cf1c71359255bfcdc36fc3717a9df5dcbfd50b555cad2a17d
SHA512

a75e8611936c8741ebad883b07b4a2933fa1828eea64a6631ab5c2286639cad7563a83474b1f8b2a997ead1d510e690bd1e8f13dc553fec60f99bf157bccc731
SSDEEP

12288:zIOD+Eq759nLpI+fBP9GmIZECcijm1sGK7qVBohYkyOTPo6sw3yObwjz:vDY3n1ZYcCm1sG3VN/OTAi3Xbw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c8d31064ea3229cd4344519cf29df1c6_JaffaCakes118

Files

c8d31064ea3229cd4344519cf29df1c6_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

aadf5c8667fe05f652d8f2e502e2b9d7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

MessageBoxA

kernel32

GetModuleHandleA
GetProcAddress

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IAlloc
QueueMemory

Sections

.text
Size: 599KB - Virtual size: 598KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 272KB - Virtual size: 271KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ