e0e6fdba93a891b5482d804616d04be0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e0e6fdba93a891b5482d804616d04be0_JaffaCakes118
Size

226KB
MD5

e0e6fdba93a891b5482d804616d04be0
SHA1

aa753484ad6641401e169b93eceb5f4a85cd2316
SHA256

1c94c053b9dda88ee05d07f561cf37542db0b5a507cd5691e0bd6d6a46730249
SHA512

a516fa9c15b2eca035570e9b866053cfb77df00ef86e37eabb3679100f146a63d860f427f7ed02e6a432abf6b617093cf99708fbce232896e91c8817ac8df227
SSDEEP

6144:UUzqbozcx2tT11RVfnHus9CvasO7YcweELv:Jzmoo4T3R4VvaP7BYLv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e0e6fdba93a891b5482d804616d04be0_JaffaCakes118

Files

e0e6fdba93a891b5482d804616d04be0_JaffaCakes118
.dll windows:4 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Exports

Exports

CreateMainProc
CreateProtectProc
DllCanUnloadNow
DllGetClassObject
RealLogoff
RealLogon
Startup

Sections

.text
Size: 207KB - Virtual size: 600KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE