dfacf13b601477e4e1a79f95345d119e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dfacf13b601477e4e1a79f95345d119e_JaffaCakes118
Size

7KB
MD5

dfacf13b601477e4e1a79f95345d119e
SHA1

d0786bba32a860123730b4ae1817be077a9dcbfd
SHA256

026be355ffb86fe16afc6e64a4f6307e756924fde449a760f3c26a40b6690570
SHA512

2e6b33d1ce400573da75a26977f2bf30db5faf884a3bc3c03e48d83d3ae534945f92c4b9a9b3d7807ec4597fe91c02b6ee7a01f1c714ee0f94e6c0fb8cadb828
SSDEEP

192:fu6reUO5gbnifAlGtZD8KoXmTatmWtNrRWTaYb:G8C58ifAl0ZD8K9UmWXrRWTJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dfacf13b601477e4e1a79f95345d119e_JaffaCakes118

Files

dfacf13b601477e4e1a79f95345d119e_JaffaCakes118
.dll windows:6 windows x86 arch:x86

0b40a15f873f8e470b17ad5b4d1ca913

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AECache.pdb

Imports

msvcrt

_except_handler4_common
_amsg_exit
_initterm
free
malloc
_XcptFilter

kernel32

InterlockedCompareExchange
GetTickCount
QueryPerformanceCounter
Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetLastError
BaseFlushAppcompatCache
InterlockedExchange
GetCurrentThreadId

wdscore

WdsSetupLogMessageA
CurrentIP
ConstructPartialMsgVA

Exports

Exports

Sysprep_Clean_AECache

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 844B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ