153ec544b2edcc0ba51ba53c3a566568_JaffaCakes118 | Triage

Sharing

General

Target

153ec544b2edcc0ba51ba53c3a566568_JaffaCakes118
Size

192KB
MD5

153ec544b2edcc0ba51ba53c3a566568
SHA1

86ffcaf0632b8f5385cf3f59cea34b38532522bd
SHA256

667cd9542ea58f65a3a70513ae0761f17533d896049f322b79e446846cf770c0
SHA512

932d812eb5b4fcbb5b6cbeb6efafcb494ed127dcc4a4fc8cae9516001ab55ad4ff1e6ff705986f71b154c064c19762e99197b05d13f4fb7a8b5b641e13521a0e
SSDEEP

3072:PwlchPwCx4Y8uDfJ/eIQt+7sO8bQ8P1nyGN3qhYzgax75EVnEXKxFxAecRqTKjfw:kcjMuDfZeXM7sO8bQ215UhYzgEiVnE0z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
153ec544b2edcc0ba51ba53c3a566568_JaffaCakes118

Files

153ec544b2edcc0ba51ba53c3a566568_JaffaCakes118
.dll windows:5 windows x86 arch:x86

94a9a5289654f0d5c0b21d86de1f2328

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

U:\baWagJZiGjnt\xinTTzwzeHjrhf\dwseljzoh\oeswbibf.pdb

Imports

kernel32

GetCommState
CreateFileMappingA
HeapSize
SetEndOfFile
DeleteFileA
VirtualProtect
SearchPathW

shlwapi

PathUnquoteSpacesW

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

user32

CheckRadioButton
MessageBoxW

ntdll

RtlCaptureContext

Exports

Exports

?InsertCustomData@@YGKXZ

Sections

.text
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.code
Size: - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ