dcdba85fc74ab070fced89abe68d2d00_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dcdba85fc74ab070fced89abe68d2d00_JaffaCakes118
Size

57KB
MD5

dcdba85fc74ab070fced89abe68d2d00
SHA1

9c8d0ed5c46de80d6f1f7ba322cd1d1a4d61446c
SHA256

145f7ff58001b7bf6a67f438d97b5e8110c5bc5ff26e1af1a52691a8383a8fde
SHA512

69e080a066f4fbebe2994179afdd061a11ad0ef3bc337c588f3cca8adae0cf4c74ac743496d8ab991b698e92393acc44ecc44dd9b5852b98683766f446747d67
SSDEEP

768:W+/4lZP/TT4YI8aMu5ku/U5CnU9EcpqYVTbEMOI5hD+6O42gVKNi+90YDt:P4H8YCeuMMUD8YlbEYq6Vms+9ZDt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dcdba85fc74ab070fced89abe68d2d00_JaffaCakes118

Files

dcdba85fc74ab070fced89abe68d2d00_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a3cfb2b1d332f0a434ad0c10452f6389

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CryptGetKeyParam
CryptSetKeyParam
DeregisterEventSource
GetMultipleTrusteeA
GetSidSubAuthority
IsTextUnicode
ObjectDeleteAuditAlarmA
RegDeleteValueA
RegSaveKeyA

kernel32

CreateFiber

user32

ArrangeIconicWindows
CharLowerBuffA
DrawCaption
GetMessagePos
MapVirtualKeyExA
PackDDElParam
RedrawWindow
SendIMEMessageExA
SetCaretBlinkTime
ShowCursor
UnhookWinEvent

Sections

.wjwbu
Size: 22KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qzo
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.dap
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ibkze
Size: 25KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ