fad05b29cb610145e6b83e781e4eb044_JaffaCakes118 | Triage

Sharing

General

Target

fad05b29cb610145e6b83e781e4eb044_JaffaCakes118
Size

116KB
MD5

fad05b29cb610145e6b83e781e4eb044
SHA1

ef7ad0f593d38ef93111b289b5e3537a5227dde5
SHA256

dcadcc285e7262d2f9f138e7c3ff0fa1ceca1d06d9e15c151f38eaa4f0a60eed
SHA512

2f77d320f5f38e820dfc29da9b977447f6809c840c33fbed3d11ce46c96d520e64789ce6b35978b375b3cf1711dd2644b8142c72a07874afcfa0d57f2a0875ea
SSDEEP

1536:qcU+ec3KbmYT3R1vS42Tne/xRjvlZagwM3HD:qN+ec3KbmYbPV2TnephvlZagf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
fad05b29cb610145e6b83e781e4eb044_JaffaCakes118

Files

fad05b29cb610145e6b83e781e4eb044_JaffaCakes118
.dll windows:4 windows x86 arch:x86

c2dd8b2417c47c04976d15f19f79dc5b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ald.pdb

Imports

kernel32

Beep
HeapReAlloc
HeapDestroy
OpenEventW
FindResourceExW
FindResourceW
SetLastError
HeapAlloc
GetProcessHeap
HeapFree
OpenSemaphoreA

rpcrt4

RpcStringBindingParseW
RpcBindingVectorFree
RpcBindingToStringBindingW
RpcEpUnregister
RpcEpRegisterW
RpcServerListen
RpcServerRegisterIfEx
RpcServerRegisterAuthInfoW
RpcServerInqDefaultPrincNameW
RpcImpersonateClient
RpcRevertToSelfEx
UuidFromStringW
NdrAsyncServerCall
NdrServerCall2
RpcStringFreeW
RpcServerInqBindings
RpcServerUseProtseqW
RpcAsyncCompleteCall
UuidCreate
UuidToStringW
RpcMgmtStopServerListening
RpcAsyncAbortCall

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrh
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 430B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ