cf4298ea73551b9968c9723f3caa3175_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cf4298ea73551b9968c9723f3caa3175_JaffaCakes118
Size

204KB
MD5

cf4298ea73551b9968c9723f3caa3175
SHA1

bfac5f4a499e7b307d55e0d78f23690853548d24
SHA256

a88f45e984e287fd65e38fe74150ac4df71f80f0f74608e0346de31fd43393d1
SHA512

178afd58a9d5f04ee3afca3c3e4006429af9b641ebeb9377092da633e7648c5f4c4f5df770b30276ae2e0fb2c554f7cc29d210b4ed106066ab338f88d892d9fc
SSDEEP

6144:VXBlMjX+I2ahwDAXt2cgRUtV/LiYB/mq:VQjXPhwDyTgRUXLiYD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cf4298ea73551b9968c9723f3caa3175_JaffaCakes118

Files

cf4298ea73551b9968c9723f3caa3175_JaffaCakes118
.dll windows:4 windows x86 arch:x86

31837eb206450fcf06067217cb42e541

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\src\datatype\lsd\codec\ralf.pdb

Imports

msvcr71

malloc
free
_initterm
_adjust_fdiv
??2@YAPAXI@Z
_except_handler3
__dllonexit
_onexit
__CppXcptFilter
??3@YAXPAX@Z

kernel32

DisableThreadLibraryCalls

Exports

Exports

RACreateDecoderInstance
RACreateEncoderInstance

Sections

.text
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 96KB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ