ea6c0d4bce4cbefbda23070ec66031bd_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ea6c0d4bce4cbefbda23070ec66031bd_JaffaCakes118
Size

104KB
MD5

ea6c0d4bce4cbefbda23070ec66031bd
SHA1

6870eeb662eec12944b3b2b224d20a11fda8567f
SHA256

828ef8bb7ca3bc4880f71a34b46318009a7c19d9e211e74d2cf282d97ed28b96
SHA512

7643d7e5b116655378d12c3da13a0af47daf5530e8ab98d44ccf6890c1464f3e5eb4ff0f89f8a87f6174f08934257b2416354a6afa89084d482ab17e2fd1f537
SSDEEP

3072:ydPoponOI2O/j8XQqG7kpU0weOXEwYL9zC:ydPopoOhG3Ae0oX65

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ea6c0d4bce4cbefbda23070ec66031bd_JaffaCakes118

Files

ea6c0d4bce4cbefbda23070ec66031bd_JaffaCakes118
.dll windows:4 windows x86 arch:x86

76617e1a081d29216f976c00e1630357

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

gubed.pdb

Imports

user32

MessageBoxA
wsprintfA
CharNextA
LoadStringA
CharPrevA
MessageBoxExA

advapi32

GetSidLengthRequired
FreeSid
GetSecurityDescriptorDacl
RegEnumValueA
SetFileSecurityA
SetSecurityDescriptorDacl
GetSidSubAuthority
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
RegOpenKeyExA
RegCloseKey
InitializeSid
RegQueryValueExA
AllocateAndInitializeSid

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListA

Exports

Exports

qxjpfb

Sections

.text
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 486B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ