efec71f8e65fc5852966d2168e970dc6_JaffaCakes118 | Triage

Sharing

General

Target

efec71f8e65fc5852966d2168e970dc6_JaffaCakes118
Size

449KB
MD5

efec71f8e65fc5852966d2168e970dc6
SHA1

3067f20596be784cc805d760ebb931a6436c2732
SHA256

b28c25b37d5949f8f7fffb2fadd95caefc39db9aa99112f2df96759271704e61
SHA512

d4a944c61a107b80f6e345de046fa2f4d832c364136064f69964a4545c059fa8c4c36715e1a6176e6b2d42f77b488e5b9704c9fa55694efa8a41c5a65b7242ea
SSDEEP

12288:aaYnZM5ATMTeYhnEktJLcY6+CEs8av2c/bDxzBXpo8vd6HZ:0ZU5ThnBthblU+UFBu8vd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
efec71f8e65fc5852966d2168e970dc6_JaffaCakes118

Files

efec71f8e65fc5852966d2168e970dc6_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

c116cfc16e3a5580830487a963b0fc7f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

UnrealizeObject

ole32

IsEqualGUID

comctl32

ImageList_SetIconSize

wininet

InternetSetOptionA

urlmon

URLDownloadToFileA

shell32

SHGetSpecialFolderPathA

netapi32

Netbios

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

CODE
Size: 435KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE