dab673b36d28cbc1fe8c9164ee48cda3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dab673b36d28cbc1fe8c9164ee48cda3_JaffaCakes118
Size

80KB
MD5

dab673b36d28cbc1fe8c9164ee48cda3
SHA1

07c991ab066dc50302d42de6b411ec83049a9407
SHA256

bb45ba0e7cfd1e0bf4617d627d31724529f415d2ca076b615346cd1707968f74
SHA512

da92957759c5cdc074bc0119c6ea5e94b9020aa711c69e1ff92da7e45a8b6b5324e429e1f60ece79ba16556417d60d39a3163d30169d8c23b9dc6948221f82e9
SSDEEP

1536:uJOtl/A4oc9BsGko6JCBwcBI3MBe1sOIZ:0Su4oc9f6JCBw2I3l11I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dab673b36d28cbc1fe8c9164ee48cda3_JaffaCakes118

Files

dab673b36d28cbc1fe8c9164ee48cda3_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
P2EProc
Socksify
UnSocksify

Sections

.text
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.HookSec
Size: 4KB - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ