ded339fa17e1d987e9de7bed120aec5f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ded339fa17e1d987e9de7bed120aec5f_JaffaCakes118
Size

96KB
MD5

ded339fa17e1d987e9de7bed120aec5f
SHA1

12a24182546103aea7109b7e3ec27465ec6bec56
SHA256

756e21e736b4cce6dc15d25d1381d243a56790ac500a64a52df455cbdc9fdedf
SHA512

c95b8346c2a2ec5a4a379bdab5f7a95454538bc8a189b5960099cbac42bf96acd8c6d5476945446cc6bcc8ab1ac3cf87701257613c3a53e9f01b441571bddb45
SSDEEP

3072:coLo0tbNXta3cdEUt77x34m9FBoswnQTFJFHH:tP5Xta3ytx34m65nQTFfH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ded339fa17e1d987e9de7bed120aec5f_JaffaCakes118

Files

ded339fa17e1d987e9de7bed120aec5f_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

fdbfec85672f73d2a4d49635454936d4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetProcAddress
GetModuleHandleA
LoadLibraryA
ExitProcess

user32

MessageBoxA

Exports

Exports

DisableHook
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
EnableHook
SetupShellHook

Sections

.text
Size: 1KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 85KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.perplex
Size: 1KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ