fb100ddf6566f449a3ef09c29a073cde_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fb100ddf6566f449a3ef09c29a073cde_JaffaCakes118
Size

624KB
MD5

fb100ddf6566f449a3ef09c29a073cde
SHA1

15b8d8cb3cd750427394e3df2cd4b94ccb0cfde2
SHA256

94550e710cc4a2af7a04be833e854aa4f5811ad1f6049ede5e4161a12a31c8f5
SHA512

cd12558801822c237621124240e8468cea25ad8b152250993d59383b91ff2cce5593d5cb5ea04717789400165bbec5fcd40f4ba967884864b4ebb92da34760f4
SSDEEP

12288:cls/FVUe9X9oUk3N3QwhSDeWWoPt7f5dJ5f5sCQZcddpMk7zA1Qw:ccPx8N3dhSKWWgt7f5HEcpnAD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fb100ddf6566f449a3ef09c29a073cde_JaffaCakes118

Files

fb100ddf6566f449a3ef09c29a073cde_JaffaCakes118
.dll windows:4 windows x86 arch:x86

09c9eae57c32288b06583721a7a80bd8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

advapi32

DeleteAce
AdjustTokenGroups
CloseEventLog
CryptGetHashParam
CryptSetHashParam
DuplicateToken

kernel32

LocalFileTimeToFileTime
MultiByteToWideChar
RaiseException
HeapReAlloc
InterlockedDecrement
SetFileTime
ExitProcess
MulDiv
GetModuleHandleW

Sections

CODE
Size: 532KB - Virtual size: 535KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE