011906fc0072aaedf1172d833b682297_JaffaCakes118 | Triage

Sharing

General

Target

011906fc0072aaedf1172d833b682297_JaffaCakes118
Size

87KB
MD5

011906fc0072aaedf1172d833b682297
SHA1

2e8e7eb1aabc80c239b1ce35891676b9203ab8e0
SHA256

b06c62f3e1c31f5d3208081c409469d59f685d6933455274c40b4a27d8fdbbba
SHA512

842b250d64287c2deaa9d75844c06dea96fb5ae0f2cfada142d7e6726f957f54b9b55db93b0c705e20afab42b9ccefe40d806115e7acaa7a709f6d10920bb10d
SSDEEP

1536:EZrVjAnXyRx24FT4VzPw689z0xtovhYPuv8/DTIXvDRjGSnwrb0Sa:EZ5SiRZFI7dtcCGkLWdSM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
011906fc0072aaedf1172d833b682297_JaffaCakes118

Files

011906fc0072aaedf1172d833b682297_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

a27d67006dd09969e3f30309397dc0b1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

CharNextA

advapi32

RegDeleteKeyA

shell32

SHGetFileInfoA

ole32

CoGetClassObject

oleaut32

SysFreeString

shlwapi

PathFindExtensionA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 59KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE