276a37bb17d1a0186f3254da49342c7e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

276a37bb17d1a0186f3254da49342c7e_JaffaCakes118
Size

120KB
MD5

276a37bb17d1a0186f3254da49342c7e
SHA1

40319d520430d7311c26e8f8ac564f5b75e943b9
SHA256

2dedd9dbc17fa94014a9fdb6e1ad67403412287b2c046420caa3129e71f118b7
SHA512

03902a0a11a02018331b6822a3b3d107c16beb42fac62fbd1170e01e324bd02b7bcaefddd9b88f4f89c70a10818b68573cd95a6726fc4e1464fffbd7cb925cc4
SSDEEP

3072:cIZzTfJGPafaKLB28R8jeV+FofwLzFP+:RzTEPMLfRgg+FomJ+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
276a37bb17d1a0186f3254da49342c7e_JaffaCakes118

Files

276a37bb17d1a0186f3254da49342c7e_JaffaCakes118
.dll windows:4 windows x86 arch:x86

76617e1a081d29216f976c00e1630357

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

msdtcdbgdbg.pdb

Imports

user32

MessageBoxA
wsprintfA
CharNextA
LoadStringA
CharPrevA
MessageBoxExA

advapi32

GetSidLengthRequired
FreeSid
GetSecurityDescriptorDacl
RegEnumValueA
SetFileSecurityA
SetSecurityDescriptorDacl
GetSidSubAuthority
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
RegOpenKeyExA
RegCloseKey
InitializeSid
RegQueryValueExA
AllocateAndInitializeSid

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListA

Sections

.text
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 526B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ