ce4077854c1e0c615292f949e9792597_JaffaCakes118 | Triage

Sharing

General

Target

ce4077854c1e0c615292f949e9792597_JaffaCakes118
Size

460KB
MD5

ce4077854c1e0c615292f949e9792597
SHA1

d2f27e34300e477cacb54c56ffdec7222d7e4883
SHA256

f25180d6285859d002a6fbd705e08c63fb03cb7191f07cd8e9ec019779f46654
SHA512

9ddcff45f541394666c9634b481899bb3c3296b4032343e4532c0e649f5565e3e7f6a951cd097aa955c6397d06cec28af9004275dee3b2f971f4692faeda6394
SSDEEP

6144:vrfoZDgW2vWUgpZ3W5x8zIj8aHSvxunTY+ZU:vqeU3m5Gbv+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ce4077854c1e0c615292f949e9792597_JaffaCakes118

Files

ce4077854c1e0c615292f949e9792597_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

783dfdcccf80183e0d587c5ce54d34fd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DisableThreadLibraryCalls
HeapAlloc
GetSystemInfo
GetVersionExA
HeapCreate
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
DeleteCriticalSection
FreeLibrary
GetProcAddress
LoadLibraryA
lstrcpyA
MultiByteToWideChar
lstrlenA
lstrcatA
WideCharToMultiByte
lstrlenW
GetModuleFileNameA
HeapFree

user32

CharNextA

ole32

CoCreateInstance

oleaut32

SysFreeString
RegisterTypeLi
LoadTypeLi
SysAllocString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 332KB - Virtual size: 328KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 112KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 610B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ