5c535c5e1819d415e34163bad8cf11c2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5c535c5e1819d415e34163bad8cf11c2_JaffaCakes118
Size

124KB
MD5

5c535c5e1819d415e34163bad8cf11c2
SHA1

092ebb58ab7160cf39ef4a1019c11a179935335d
SHA256

f4163e90d58414e331ccfa1f7a4c46e966629a0d362ae7279c99ef18dfa68187
SHA512

bcc7b99fd5620d3e9d81c905ac32864a98b4e4cae6013921b0b0379f240bc932d69f17ed6f0ef45988d8e11b8eb8637140b6c791faf8aef8055f6b4a17d1f4e0
SSDEEP

3072:CzSxjcnqsR2Nqp+YxESp/DEb3n6h8q/ofwPjGyDr:4SFrNqp+Hvqh8KosjGy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5c535c5e1819d415e34163bad8cf11c2_JaffaCakes118

Files

5c535c5e1819d415e34163bad8cf11c2_JaffaCakes118
.dll windows:4 windows x86 arch:x86

1639b9a29d1e09acc3fb19b970be6310

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

gubed.pdb

Imports

user32

MessageBoxA
wsprintfA
CharNextA
LoadStringA
CharPrevA
MessageBoxExA

advapi32

RegEnumValueW
FreeSid
GetSecurityDescriptorDacl
RegQueryValueExW
SetFileSecurityA
SetSecurityDescriptorDacl
GetSidSubAuthority
AddAccessAllowedAce
InitializeSecurityDescriptor
RegOpenKeyExW
RegCloseKey
InitializeSid
GetSidLengthRequired
AllocateAndInitializeSid

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListA

Exports

Exports

maysll

Sections

.text
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 530B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ