36824ac002678a01c24f38710e32ef52_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

36824ac002678a01c24f38710e32ef52_JaffaCakes118
Size

101KB
MD5

36824ac002678a01c24f38710e32ef52
SHA1

d3db4a10e1ba15efb0a6d9f1ace91d87c1c63ee2
SHA256

ec77a75289cd80a642b0c6ae074cf2990bcc5f78c98fca81da128783dae01f0c
SHA512

0008d9840113387dd6ee2f57c111b3c33c9137dc7f3f62fe6a427449d2a72f86752d0794c5b779584270c021ae5f497ce40fe9a6378fe00c0c5f28069ab820bd
SSDEEP

3072:W9iPvPN2SqSE97mwSjwJ7srb3BPNUS/CLeloEE8aQ:W9iPHN2SqS/jAsrbBP1leDQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
36824ac002678a01c24f38710e32ef52_JaffaCakes118

Files

36824ac002678a01c24f38710e32ef52_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
Ohpcpmo
DllMain
DllRegisterServer
DllUnregisterServer
ServiceMain

Sections

CODE
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 223B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ