97572437b6a78aaaa9d7925a3e3c48a3_JaffaCakes118 | Triage

Sharing

General

Target

97572437b6a78aaaa9d7925a3e3c48a3_JaffaCakes118
Size

252KB
MD5

97572437b6a78aaaa9d7925a3e3c48a3
SHA1

20ec3cfc185ce474f4d86bf87a6dded70183ef61
SHA256

815e55850982ba8ef596047737c5ee717dfbe1bc68887a46fc78ed7962201dde
SHA512

cd757eec776d091a4a8265d6a9be0cceb07bd618405f81b32435ba54765fdf98081cb1316526a97cfa7bc2369cc445415854eefb74994bc5a9d93fc4577b1d78
SSDEEP

6144:dTa12CoCckAe8a0jbUjmJmdG/i8OJQvdjl2psxtd89:ik3djbo4mAK8eQvJ4psx89

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
97572437b6a78aaaa9d7925a3e3c48a3_JaffaCakes118

Files

97572437b6a78aaaa9d7925a3e3c48a3_JaffaCakes118
.dll windows:4 windows x86 arch:x86

346d60e37a38da26b7d234c6530424cb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_initterm
_adjust_fdiv
malloc
memmove
free

kernel32

EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
FreeLibrary
SetErrorMode
LoadLibraryA
GetProcAddress

Exports

Exports

JgedCreate
JgedDestroy
JgedDisableComponent
JgedDuplicate
JgedEnableComponent
JgedProcess
JgedSetOption
JgedStart

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 678B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 192KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE