df9442d27ce2096ee680a87d98bb1551_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

df9442d27ce2096ee680a87d98bb1551_JaffaCakes118
Size

124KB
MD5

df9442d27ce2096ee680a87d98bb1551
SHA1

6c8b198b6d3803643014d980965c9e6d86525e06
SHA256

72e407d335a1a0142863dd36b0a14d1414728cd5481a48bd5a1c183e6610f204
SHA512

70f3995caa511cef5bc4cbd06bd5c6af37592ddb77630787e1259249b718c7a4e1d17cc8eba04670913faf2a179e9192e901ff7502c2e28e9b411497476efe62
SSDEEP

3072:QcSA0uJmGIH/l0BUJnF/GEkJzYxA1Xcvdfofw77:NEem5rJUGpfoE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df9442d27ce2096ee680a87d98bb1551_JaffaCakes118

Files

df9442d27ce2096ee680a87d98bb1551_JaffaCakes118
.dll windows:4 windows x86 arch:x86

1639b9a29d1e09acc3fb19b970be6310

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

gubed.pdb

Imports

user32

MessageBoxA
wsprintfA
CharNextA
LoadStringA
CharPrevA
MessageBoxExA

advapi32

RegEnumValueW
FreeSid
GetSecurityDescriptorDacl
RegQueryValueExW
SetFileSecurityA
SetSecurityDescriptorDacl
GetSidSubAuthority
AddAccessAllowedAce
InitializeSecurityDescriptor
RegOpenKeyExW
RegCloseKey
InitializeSid
GetSidLengthRequired
AllocateAndInitializeSid

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListA

Exports

Exports

gmizdjqi

Sections

.text
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 530B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ