0aaa29232e18981572949f8433c3081c_JaffaCakes118 | Triage

Sharing

General

Target

0aaa29232e18981572949f8433c3081c_JaffaCakes118
Size

28KB
MD5

0aaa29232e18981572949f8433c3081c
SHA1

7b2b5ed742aad19446d2aec129446b382872711c
SHA256

b58ec7a88b636a6cd6f0176d8926dfdfd2b8dd7e2b57845ca31a7a160bac2d50
SHA512

ecfe3fd470e37db010007417136d652a260ebc3be7b7890bc2725a6cb7ccd76dd70891257af2275d0b41c3179aba28df31282424d7a1a2c5851b4b81d2729014
SSDEEP

768:EbKYuKslLONK2Gf+9DK/9wKRjlrXdLF+TsfWdHpMoiV:EbKNdINK2e+hK/9LjlrtPfWdJ2V

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0aaa29232e18981572949f8433c3081c_JaffaCakes118

Files

0aaa29232e18981572949f8433c3081c_JaffaCakes118
.dll windows:4 windows x86 arch:x86

2a78e0df738c0b802aab6c985ee3dc49

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

BuildImpersonateExplicitAccessWithNameA
ConvertAccessToSecurityDescriptorA
CryptDeriveKey
CryptHashData
GetCurrentHwProfileA

kernel32

ExitProcess
GetACP
GetProcAddress
LoadLibraryA
VirtualProtect

user32

CheckMenuItem
DialogBoxParamW
EndDialog
RegisterWindowMessageW

Sections

.itext
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: 15KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE