deb95bb25e6490bee2d560447db5c9f8_JaffaCakes118 | Triage

Sharing

General

Target

deb95bb25e6490bee2d560447db5c9f8_JaffaCakes118
Size

562KB
MD5

deb95bb25e6490bee2d560447db5c9f8
SHA1

3799a3600265d253a30421feb9810c6a98020e69
SHA256

36db88378180ca2b7ef45e7dc65e3b779c25b8c560dbb3e5660861c993d84c4a
SHA512

1e4922ed1fb67603bb6cd66aaec992a4b6628d4458d8fc452378ffba8716649079c75e40d7d4b30073afdeaceb5ba4ab739bd5e73fe0d5ac4629d38f3d78f533
SSDEEP

12288:i0Et9YDc/Tk4Po4wSSqodPF9C2vTgYn2M4uUEkRG:ytWDcw4o4Ts/9Ckn2u0R

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
deb95bb25e6490bee2d560447db5c9f8_JaffaCakes118

Files

deb95bb25e6490bee2d560447db5c9f8_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

CODE
Size: 485KB - Virtual size: 485KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ