09b7f9b06df343a03a8ad32b90c8c876_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

09b7f9b06df343a03a8ad32b90c8c876_JaffaCakes118
Size

124KB
MD5

09b7f9b06df343a03a8ad32b90c8c876
SHA1

8b43d3b79d545f21bab5f84ece8c07b3e296b570
SHA256

6d19b7a3f0caf98a15a5fc57b1420b5075b67871eaa82e86095190aa973e6a33
SHA512

a5687ce02fdf52ea323eae1daf848f891cc755a2d16dda2c6b3a0281f7fffeb8f6ac8fe7e5519449d90ed55cc092571bf970b5a30c48dba0e11949269967b477
SSDEEP

3072:j85BGqMgC4tl492dSTtEO9A6ofwPw+5rnv:jnq1Y2dSTp9A6oK5r

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09b7f9b06df343a03a8ad32b90c8c876_JaffaCakes118

Files

09b7f9b06df343a03a8ad32b90c8c876_JaffaCakes118
.dll windows:4 windows x86 arch:x86

76617e1a081d29216f976c00e1630357

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

gubed.pdb

Imports

user32

MessageBoxA
wsprintfA
CharNextA
LoadStringA
CharPrevA
MessageBoxExA

advapi32

GetSidLengthRequired
FreeSid
GetSecurityDescriptorDacl
RegEnumValueA
SetFileSecurityA
SetSecurityDescriptorDacl
GetSidSubAuthority
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
RegOpenKeyExA
RegCloseKey
InitializeSid
RegQueryValueExA
AllocateAndInitializeSid

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListA

Exports

Exports

zmsvmd

Sections

.text
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ