06e703c30f50de8d109cf36559bac04d_JaffaCakes118 | Triage

Sharing

General

Target

06e703c30f50de8d109cf36559bac04d_JaffaCakes118
Size

16KB
MD5

06e703c30f50de8d109cf36559bac04d
SHA1

055e9ebf6a3d37db50125ba8aaf76c68bf061026
SHA256

8fc795e19eded38bc02eead7adff2995340f0e140e63479d3a7d66423155f220
SHA512

6a3026a73bd20b3dbec835f5f0235a70ac144a54f71cdf4a0512ba25ac5a8fa9c827e394f694b49418fb6c1ab10776ebbf2b15958164c8a3100faa2941b587b9
SSDEEP

384:1bPd7lSXmBzPaRXvdpT8If6BftFyghid2K1:1R7lS2BuXlpT8ICB1FyEiYK1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
06e703c30f50de8d109cf36559bac04d_JaffaCakes118

Files

06e703c30f50de8d109cf36559bac04d_JaffaCakes118
.dll windows:4 windows x86 arch:x86

491d17af8d0eb9e9432333386e3ca22a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

msvcrt

_onexit

msvcp60

??0_Lockit@std@@QAE@XZ

user32

wsprintfA

advapi32

RegQueryValueExA

Exports

Exports

CancelDll
LoadDll

Sections

.text
Size: 11KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE