d40e2b59b5c825c1921cbcb6bc5e716b_JaffaCakes118 | Triage

Sharing

General

Target

d40e2b59b5c825c1921cbcb6bc5e716b_JaffaCakes118
Size

597KB
MD5

d40e2b59b5c825c1921cbcb6bc5e716b
SHA1

4c4a76168704f0349ca1caa6ba5352aa8b8952aa
SHA256

4cca877f7e1b49fa873cd356cfcd7c695d4c76e272bae2aa49e07b84545dad95
SHA512

517f5cb01469b57ff2cc1214b25df315428f9662741ddfb988b8784b02d601c0f9dabb78764f17dc14cb16bb1bd331a34849a1a35f6bcc1e907abe50c199fd3c
SSDEEP

12288:LLQ9upde/d+5pvbx8qsMgRDh37SUDj7FtjOzEVYOCuWIP:L9dpTj0DhLT7FFOzEGO8I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d40e2b59b5c825c1921cbcb6bc5e716b_JaffaCakes118

Files

d40e2b59b5c825c1921cbcb6bc5e716b_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

51f4697869e0afc22f6d670cdfb0dac6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegQueryValueExA

user32

GetKeyboardType

gdi32

UnrealizeObject

version

VerQueryValueA

ole32

IsEqualGUID

comctl32

_TrackMouseEvent

urlmon

CoInternetCreateZoneManager

wininet

InternetSetOptionA

shell32

ShellExecuteExA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 577KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE