JaffaCakes118_6615b1827642aaa011cb27391c63b214 | Triage

Sharing

General

Target

JaffaCakes118_6615b1827642aaa011cb27391c63b214
Size

232KB
MD5

6615b1827642aaa011cb27391c63b214
SHA1

2a3a08e027b840c82ce74b9561326cedff3b4caa
SHA256

66ab31fc088b2b58b1ab428a06b6bf067ca401947ba4f17bbb6ffe5f46f1c473
SHA512

626812da94a2113c3027da6112aa9e2508f6ecaf1ba85b6e24594a4192ce0eb921e21a3508bd7920dc491f93f21098590873225002811e9236a0e7085b752709
SSDEEP

6144:VrJp0WOsHSN6sZZVvqCenLR9rhFGrxYGcjaY20IgMy:hJpksH2jVyDLR9cxtcjaY2I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/95a8370c36d81ea596d83892115ce6b90717396c8f657b17696c7eeb2dba1d2e

Files

JaffaCakes118_6615b1827642aaa011cb27391c63b214
.zip

Password: infected
95a8370c36d81ea596d83892115ce6b90717396c8f657b17696c7eeb2dba1d2e
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DllCanUnloadNow
DllUnregisterServer
DllRegisterServer
DllGetClassObject

Sections

.text
Size: 242KB - Virtual size: 249KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 50KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 125KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ