0db0da78ec83568841b5087b06ea7d2b_JaffaCakes118 | Triage

Sharing

General

Target

0db0da78ec83568841b5087b06ea7d2b_JaffaCakes118
Size

100KB
MD5

0db0da78ec83568841b5087b06ea7d2b
SHA1

bbceccc2b36c399ef8b6018475c4f2cdc51c106c
SHA256

2c8616f3e613e5d2da67c6a2be44b6b6e91215f5bd5c8ebf7bd32629e1397488
SHA512

978b694e0de53427a5a63030458748bf7181bfd666ef4987b683d7501ed092a2341f52651bb22b55ed28cc973bd01ad5d9a385e46b40d1eccb7c009bf261469d
SSDEEP

3072:crfbRdt0ponOI2O/j8XQqGKxY0weLr7zb:chdt0poOhG3F0Z7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0db0da78ec83568841b5087b06ea7d2b_JaffaCakes118

Files

0db0da78ec83568841b5087b06ea7d2b_JaffaCakes118
.dll windows:4 windows x86 arch:x86

76617e1a081d29216f976c00e1630357

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

gubed.pdb

Imports

user32

MessageBoxA
wsprintfA
CharNextA
LoadStringA
CharPrevA
MessageBoxExA

advapi32

GetSidLengthRequired
FreeSid
GetSecurityDescriptorDacl
RegEnumValueA
SetFileSecurityA
SetSecurityDescriptorDacl
GetSidSubAuthority
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
RegOpenKeyExA
RegCloseKey
InitializeSid
RegQueryValueExA
AllocateAndInitializeSid

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListA

Exports

Exports

czal

Sections

.text
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 476B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ