43ccca1b1f56ec283ffe34bd8da4c7e9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

43ccca1b1f56ec283ffe34bd8da4c7e9_JaffaCakes118
Size

200KB
MD5

43ccca1b1f56ec283ffe34bd8da4c7e9
SHA1

7378f77313b8a12895917bd97b176e45b1da47ab
SHA256

4a05227b1b4e545379379bedfe3fd7c926c188e1a2e644166c824f19a8517751
SHA512

3ad666906b9bf5c87f1dac3f51aa1c2f9b34124e88dfaa7317615ca571b6c3e3009e595764a33f051165aa19a7b1652c3be24112fef8ec0fcd11c81bcc8eea0f
SSDEEP

3072:u1lqlbwIdjDUGlerFjo05QUv8unT9GPekg7hd9Gxhm7z3TzgTBeqYCwNk605yHzE:4gEIkjoinv5nTDVnGDm77gTtYvVa1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
43ccca1b1f56ec283ffe34bd8da4c7e9_JaffaCakes118

Files

43ccca1b1f56ec283ffe34bd8da4c7e9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

abc0f930acd857aeac079415667b941c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TlsSetValue
LCMapStringA
OutputDebugStringA
OutputDebugStringW
GetStringTypeW
DebugBreak
HeapReAlloc
EnumSystemLanguageGroupsW
GetTimeZoneInformation
IsValidCodePage
WriteConsoleW
CompareFileTime
LCMapStringW
GetStringTypeA
GetLocaleInfoA
GetCPInfo

oleacc

CreateStdAccessibleObject
CreateStdAccessibleProxyA

winmm

sndPlaySoundA

advapi32

LookupAccountSidA
DuplicateTokenEx
AddAce
PrivilegeCheck
InitializeSecurityDescriptor
GetUserNameA
IsValidSecurityDescriptor
QueryServiceStatus
SetSecurityDescriptorOwner
GetSecurityDescriptorLength
RegOpenKeyExW

shlwapi

PathAddBackslashW

shell32

SHChangeNotify
SHGetMalloc
SHGetPathFromIDListW

Sections

.text
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ