d5985f8c5a0f85d9fedfbc44903d3015_JaffaCakes118 | Triage

Sharing

General

Target

d5985f8c5a0f85d9fedfbc44903d3015_JaffaCakes118
Size

710KB
MD5

d5985f8c5a0f85d9fedfbc44903d3015
SHA1

f3dd1e127e133c2d2532b185fb02b6bd9637fd04
SHA256

c76b06afbdd03df97f80c87f01a2cde48dedf4edfa0b6dbb4ec671deee4e96f9
SHA512

bb2f473157c626f904dbc506b9470d48d3080cba7d433b32075d54447fd37bac590d42b714f7c00d98d8437040456c2f2d86c32460bae40ce420584a41ce6218
SSDEEP

12288:yHCqAM6vj721fUXMgf1PuLpHz9vw8Gjk2PFnZNpyUt4VQ1RUO:yiqTyO6dMLvwosXNdt4VyUO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d5985f8c5a0f85d9fedfbc44903d3015_JaffaCakes118

Files

d5985f8c5a0f85d9fedfbc44903d3015_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

CODE
Size: 494KB - Virtual size: 493KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 159B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 167KB - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ