02188699ad4f34c41868b8a6da06f7c3_JaffaCakes118 | Triage

Sharing

General

Target

02188699ad4f34c41868b8a6da06f7c3_JaffaCakes118
Size

64KB
MD5

02188699ad4f34c41868b8a6da06f7c3
SHA1

7793a75d48f5c0d5af6a177905343ebafd1be286
SHA256

ed591422f48d5f4828b051d865217add8c9a51e69f23dd2bb76e59e851bec6c3
SHA512

6009c88e64dd73a4969572859c9351d68b4f33313dcdba4e3a60fec8add81c8e2bff420e14a4579dd4fca93022dbbaddb16d7bf4a69d40b645c2d5a8d461912d
SSDEEP

1536:BfQAl+7ovOQq5egfyULgsXlPRmsZrl7rn8p:dQAl+pQqEEyUPPblb8p

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
02188699ad4f34c41868b8a6da06f7c3_JaffaCakes118

Files

02188699ad4f34c41868b8a6da06f7c3_JaffaCakes118
.dll windows:4 windows x86 arch:x86

d789bbd14d9363f075bb8a0efcaa628b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

msvcrt

time

user32

UnhookWindowsHookEx

advapi32

RegQueryValueExA

Exports

Exports

CancelDll
LoadDll

Sections

.text
Size: 8KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE