faf2018401931353455e9f0a2995e2eb_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

faf2018401931353455e9f0a2995e2eb_JaffaCakes118
Size

348KB
MD5

faf2018401931353455e9f0a2995e2eb
SHA1

6bcbbcba1e36e3e43372e78905c3be440cc66be3
SHA256

e1e6587dd122d75ac067eb7026b72e88d8ceb00158d83e84607329d7f31b617a
SHA512

0a3edb68e6b376134f3ce587067ef3047b8290895f9bea07d6d3ed2ee127d2e79804257b09cd8ce9e74397de6be872bcd2a121a325377b227f1012ab54295a8f
SSDEEP

6144:en6TQtQb5D9EfHWASwBk9qWQped2wdTR2AqvFYMMbQy:e65FefDznMBjqdMM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
faf2018401931353455e9f0a2995e2eb_JaffaCakes118

Files

faf2018401931353455e9f0a2995e2eb_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 248KB - Virtual size: 247KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ