ff7a30836299204b55d66673500b9c93_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ff7a30836299204b55d66673500b9c93_JaffaCakes118
Size

100KB
MD5

ff7a30836299204b55d66673500b9c93
SHA1

bb1d7ecca2a1882118f9ff1e7c8f7e31b4eb837f
SHA256

9786f01269ea92ddfe28a32074e0c33e7cc6ca6b8cba12142ac4cdc0e9b94f04
SHA512

19c78b3eaadaf2ce0bfe404b34ab8424e490ca7cec38a36e06a8c29e26c1e1ed1dad6e5fb62de685e0fb55c7f6ced739a3baa45615412231660528d5b8f59f8a
SSDEEP

1536:tNGoTD/eOjBfxsj20S3jjRppppp4rRYItmfXqtL:tNsOcjtSOqIt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff7a30836299204b55d66673500b9c93_JaffaCakes118

Files

ff7a30836299204b55d66673500b9c93_JaffaCakes118
.dll windows:4 windows x86 arch:x86

37f5621fe49c7d81387ae76631f5111d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ord795
ord843
ord849
ord864
ord395
ord844
ord841
ord329
ord476
ord248
ord765
ord346
ord349
ord775
ord770
ord772
ord724
ord774
ord385
ord722
ord443
ord377
ord441
ord214
ord304
ord305
ord811
ord362
ord364
ord397
ord365
ord477
ord512
ord511
ord845
ord513
ord822
ord522
ord225
ord552
ord509
ord318
ord312
ord406
ord793
ord515
ord419
ord553
ord657
ord594
ord550
ord551
ord444
ord447
ord525
ord528

Exports

Exports

GetHeroAudio

Sections

.text
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ