3c177dd0803f0eed8d8009fb8410a68c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3c177dd0803f0eed8d8009fb8410a68c_JaffaCakes118
Size

256KB
MD5

3c177dd0803f0eed8d8009fb8410a68c
SHA1

49d1cab200a4a27449561111e23594389f593fd7
SHA256

c7227e3402985bf7d16f78fc443cc4950a9c5eec41d4594256b137e1ec697a33
SHA512

ac861f62d22d855dcbb8bb43ffbddd440c2ef381d0316a7945c2bc95910d4b013e68c18be022ded762efbced6f2230166a728329312a5f65e4c5740cfb5e85ba
SSDEEP

3072:ONLphEdybaV75jYgcMwEB6RIiGdo9v6d19CG3DD5u7ylmohytw0U:ca154sSG3Zu7ylmohytw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3c177dd0803f0eed8d8009fb8410a68c_JaffaCakes118

Files

3c177dd0803f0eed8d8009fb8410a68c_JaffaCakes118
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\root\9e1a6668\73e00025\App_Web_k8qsam9f.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 180KB - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ