d5d28ff10e58dd9b80247037a8a060eb_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d5d28ff10e58dd9b80247037a8a060eb_JaffaCakes118
Size

83KB
MD5

d5d28ff10e58dd9b80247037a8a060eb
SHA1

d42e0cef82afdb9da3897629e1ef6dbd716c9fb2
SHA256

6402f778c8b43bc50416beb2cca361eed2147dc0b5695c87ea918dc0efa85a93
SHA512

7ccad7724075e19b1dbacbe76870ae2cff3603603ceb06997e8d44fa298ada6457be76c504ee44d51195b68828e09c871248c4f57206c318cb5dcbee8415e2a6
SSDEEP

1536:TsJrzzqPdRxppppppppppppppppppppppppppppepppppppppppppppppppppppf:YJrz2PZppppppppppppppppppppppppP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d5d28ff10e58dd9b80247037a8a060eb_JaffaCakes118

Files

d5d28ff10e58dd9b80247037a8a060eb_JaffaCakes118
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\palacehotelguestportal\3806cbbc\6feb4d5d\App_Web_3rrbzltz.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ