d503cfd7797027306ef55728e1c08b42_JaffaCakes118 | Triage

Sharing

General

Target

d503cfd7797027306ef55728e1c08b42_JaffaCakes118
Size

408KB
MD5

d503cfd7797027306ef55728e1c08b42
SHA1

3028eb20b0c8e57ed266bd481a918508793e9261
SHA256

cfa188a146558d7ee83fce8a186592da7db177aa0120685dfa286c6443a1de4f
SHA512

9a6be88f3643d638c211e4f42734493b60d3d8b300dce851f11e43473992ed92c19f6e9c30d7d2fa91ba6626f6d907ea09c4f3dde3c3f331fa662ff83cea2869
SSDEEP

12288:UbJ4JFZ30xX8BlyYTtB9mdptOIUiEl76ayqzRE:UbJ475Jff9C4EE18kRE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d503cfd7797027306ef55728e1c08b42_JaffaCakes118

Files

d503cfd7797027306ef55728e1c08b42_JaffaCakes118
.dll windows:4 windows x86 arch:x86

25e1ac46cb3d9976dfd4e2dda9806bfa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

NtAllocateVirtualMemory
NtAdjustGroupsToken

rpcrt4

CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Invoke
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_QueryInterface
NdrOleFree
NdrOleAllocate
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
NdrCStdStubBuffer_Release
NdrDllGetClassObject
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
NdrDllCanUnloadNow
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
CStdStubBuffer_AddRef

kernel32

Sleep

Sections

.text
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 268KB - Virtual size: 4.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE