da76489ada27998d5bf219524667065b_JaffaCakes118 | Triage

Sharing

General

Target

da76489ada27998d5bf219524667065b_JaffaCakes118
Size

11KB
MD5

da76489ada27998d5bf219524667065b
SHA1

e6be91340ff3d0e0d2ace79652eb614c07c5ea13
SHA256

22769b797509d37ea31f385f1dd4d2ad2ac76caff10a35325fe2f1c36c6de660
SHA512

dd74f932c9352b8e7da9b0c1e32eb381afd0e4f28d9c9613ffa50d7ce11429a888116f3f4bc7f9c56926f889652007abff6674095695033bfd86705434fd6222
SSDEEP

192:R1t7h67RRGCMSTB8s7d17k+7WELrxfsTxJrV0EGBwKFmlbESlRGF3Se/Rw:TtwrP9T+s3Bvu/VRKwKkiF3hR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
da76489ada27998d5bf219524667065b_JaffaCakes118

Files

da76489ada27998d5bf219524667065b_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

9bdd9d42b2fd745e30bc8f3d0371ffd8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenW
GetVersionExA
GetSystemDirectoryW
lstrcpyW
lstrcatW
lstrlenA
MultiByteToWideChar
GetModuleFileNameA
GetProcessHeap
HeapAlloc
Sleep
RtlUnwind
lstrcmpA
CompareStringW
HeapFree

user32

wsprintfW
CharLowerA
IsChild
GetForegroundWindow
GetDesktopWindow

gdi32

SelectObject

advapi32

RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA

oleaut32

SysFreeString
SysAllocString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 822B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ