04125149fd51177fc1db5cc07a7eda3e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

04125149fd51177fc1db5cc07a7eda3e_JaffaCakes118
Size

58KB
MD5

04125149fd51177fc1db5cc07a7eda3e
SHA1

ad1958cce3a2ae32af2185b51ce02935ff4401e0
SHA256

637fcf0cacc934dd9c708a6a6a27a077dfa98f8f080e39a41b9a08a2f57dcbf8
SHA512

88787b8437f66b0a3abec28ec72f4339fb5c76a630d86bbf82404a24705208d856c3399f1b0f1eca6225f87b06f348e422fe13d842c97a203544f7a3dd1379c4
SSDEEP

1536:BfQAl+7ovOEaWQA+o3HKFzWf1j67vge0MLy173LF4:dQAl+pnWWoCWf1jwgdMLy17R4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04125149fd51177fc1db5cc07a7eda3e_JaffaCakes118

Files

04125149fd51177fc1db5cc07a7eda3e_JaffaCakes118
.dll windows:4 windows x86 arch:x86

d789bbd14d9363f075bb8a0efcaa628b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

msvcrt

time

user32

UnhookWindowsHookEx

advapi32

RegQueryValueExA

Exports

Exports

CancelDll
LoadDll

Sections

.text
Size: 8KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE