b53789bc1fb059089a20ffd5ce01b427_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b53789bc1fb059089a20ffd5ce01b427_JaffaCakes118
Size

7KB
MD5

b53789bc1fb059089a20ffd5ce01b427
SHA1

faad10973c012e650e8632a593a0beb0ada745b3
SHA256

654123d0b307dc22ea293d4e52d05593d017b49f204e811ac399aacc17f62865
SHA512

c2a796f77a0520bd11cb8221dc7ebb4a7ed9322384a58a65843171a434300cfd208817a2af48f17974df630632c268b97a60940b9f2cfa19773f8b8dd228bfd5
SSDEEP

96:lzspttM1TL22hyErap3xAGvOY8l8BEwXP9/2ouISE90lkyGlFF:S3ITEPp3x7vOngEwXP9/2RI/9VF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b53789bc1fb059089a20ffd5ce01b427_JaffaCakes118

Files

b53789bc1fb059089a20ffd5ce01b427_JaffaCakes118
.dll windows:4 windows x86 arch:x86

20d405c2b7dce035cffed4ec5af91ec8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleFileNameA
GetSystemDirectoryA
LoadLibraryA
GetLastError
Sleep
HeapFree
CreateThread
GetProcessHeap
HeapAlloc

user32

CallNextHookEx
SetWindowsHookExA

advapi32

InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
RegOpenKeyExA
RegSetKeySecurity
RegCloseKey
FreeSid
RegSetValueExA
RegOpenKeyA
AllocateAndInitializeSid

msvcrt

_initterm
_stricmp
strrchr
free
_strcmpi
malloc
_adjust_fdiv

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 980B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 418B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ