07beff433350e2a2f02637c89087d648_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

07beff433350e2a2f02637c89087d648_JaffaCakes118
Size

8KB
MD5

07beff433350e2a2f02637c89087d648
SHA1

50a7073932fb6e7b7d64ca0c4c6fc5041701c4b6
SHA256

3d49447a531d2a87065e36701a93a8a45ce778f882449f55728ed8dfa381aacc
SHA512

2081905a50dca695658f7356383585728aacb4195e856cc6f5c1a4cb24a72eb8c7e792970e95770e55a62753c04ce4649c73041143b3e3990dd3ed55bb663cfc
SSDEEP

96:a4dSt5KjgZTTSsY6AGL5RwxzGwntwBN2l4+gG9/fBbXkvNkbH:PUZSsYfGL5RwxzGWtw7O4+gG9/fRCO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
07beff433350e2a2f02637c89087d648_JaffaCakes118

Files

07beff433350e2a2f02637c89087d648_JaffaCakes118
.dll windows:4 windows x86 arch:x86

e8d7cacd53720f45e22d6337c2c39300

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetSystemDirectoryA
LoadLibraryA
GetLastError
Sleep
GetModuleFileNameA
HeapFree
CreateThread
GetProcessHeap
HeapAlloc

user32

CallNextHookEx
SetWindowsHookExA

advapi32

InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
RegOpenKeyExA
RegSetKeySecurity
RegCloseKey
FreeSid
RegSetValueExA
RegOpenKeyA
AllocateAndInitializeSid

msvcrt

_initterm
strrchr
_stricmp
free
_strcmpi
malloc
_adjust_fdiv

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 980B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 532B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ