00daa7aa2a5930fff9af04b1daca48ce_JaffaCakes118 | Triage

Sharing

General

Target

00daa7aa2a5930fff9af04b1daca48ce_JaffaCakes118
Size

50KB
MD5

00daa7aa2a5930fff9af04b1daca48ce
SHA1

2874c86f11760368d033251a635e7666edfc1950
SHA256

89ba82f33a4d7c0c887a6ac2c8283262df7b242bf53be9803360e6e05ce2153c
SHA512

66c31c139268fe51e28dd6a56ce4364426cf8e75191d9c9061cf562c2d6afabfc483ef80af7573086837d60962c53662154df939500a0b86763b0ea07a6d960d
SSDEEP

1536:BfQAl+7ovOwhhWiQm30CCy1EpGeXCH1zF:dQAl+pshWidFMXCHVF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00daa7aa2a5930fff9af04b1daca48ce_JaffaCakes118

Files

00daa7aa2a5930fff9af04b1daca48ce_JaffaCakes118
.dll windows:4 windows x86 arch:x86

d789bbd14d9363f075bb8a0efcaa628b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

msvcrt

time

user32

UnhookWindowsHookEx

advapi32

RegQueryValueExA

Exports

Exports

CancelDll
LoadDll

Sections

.text
Size: 8KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE