dec352614b31f89a4c596d26908719aa_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dec352614b31f89a4c596d26908719aa_JaffaCakes118
Size

19KB
MD5

dec352614b31f89a4c596d26908719aa
SHA1

d50596034a5fd9990b1c638b4a27aa3adbf2393c
SHA256

b00c56ce3d8c67059d56ddf8a337c9f6627883fdc9c319528a3aa62ec643b238
SHA512

d5bbe8f68d4fbcdd8b2fba4394ee11234a9d392a4e55e1420d6aea368f904ec4fc8be1a30336720e3cce5d337c118bec69446497c92349c5f830cb276b49e5d4
SSDEEP

384:69UFZwyRMy9NbAxYNxCEM84dNizNUWvmshYk/smV0:qe9bJi5NizZvdh3sk0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dec352614b31f89a4c596d26908719aa_JaffaCakes118

Files

dec352614b31f89a4c596d26908719aa_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

041be06c16a093581b6ae72fdf37df70

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

StrStrIW
PathAppendW
StrStrW

oleaut32

SysFreeString
SysAllocStringLen
VariantInit
SysAllocString

ole32

CoInitializeEx

advapi32

RegCloseKey
RegSetValueExW
RegCreateKeyExW

shell32

SHGetFolderPathW

kernel32

LoadLibraryW
WriteFile
SystemTimeToFileTime
GetProcAddress
GetProcessHeap
CreateFileW
GetModuleFileNameW
CloseHandle
GetSystemTime
MultiByteToWideChar
HeapFree
HeapAlloc
ReadFile

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 330B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ