dfb36327018c160530f8c417dcf38c99_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dfb36327018c160530f8c417dcf38c99_JaffaCakes118
Size

258KB
MD5

dfb36327018c160530f8c417dcf38c99
SHA1

8d52f716084eddc3fd3b3076ceb28c36386eae63
SHA256

b5717ae7a283e4e8968d1482859ddecc8e00b1274ada11119642ca4c76b2f0fa
SHA512

f42e746edd0f17f280e5ffb8afe199aeb232246c9907e5c13d88ba747b80af6177409a75bc2c5dee9876fb54b6c91d21b325d54615a389ec699e29e6db4d63e0
SSDEEP

3072:YdZ11Gwepo6fr2PaxOJopJ4/ipnr75ICU/LAxI03l824cn:iVGwep5CPa1JN7UjAPl8w

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dfb36327018c160530f8c417dcf38c99_JaffaCakes118

Files

dfb36327018c160530f8c417dcf38c99_JaffaCakes118
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Microsoft.GroupPolicy.Interop.pdb

Sections

.data
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 203KB - Virtual size: 202KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.extrel
Size: 512B - Virtual size: 22B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ