fa506092ebb6c8e9ce5fa5f5980b79ad_JaffaCakes118 | Triage

Sharing

General

Target

fa506092ebb6c8e9ce5fa5f5980b79ad_JaffaCakes118
Size

100KB
MD5

fa506092ebb6c8e9ce5fa5f5980b79ad
SHA1

351d4d37f93dc3dfcbc2a61765d8aa3fed6824c6
SHA256

cfbe5bc60512fc5a82eed91dbd0ccd9bcbf09204154356e3af7920c92a65309e
SHA512

fbbefe0091f6a1d01bee9a4ac9e9d2f5c36c8480e8a6dbdd582b18fc5831846b97fff5c7a7b485d6c9ec0bb270f0867a5fdd488dbca1cf6000dc90acca5854e8
SSDEEP

3072:NVuzz3gbnOd7dponOI2O/j8XQqGgZ0weXiaBE2u:NVQwbOd7dpoOhG3c0Bic

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa506092ebb6c8e9ce5fa5f5980b79ad_JaffaCakes118

Files

fa506092ebb6c8e9ce5fa5f5980b79ad_JaffaCakes118
.dll windows:4 windows x86 arch:x86

76617e1a081d29216f976c00e1630357

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

gubed.pdb

Imports

user32

MessageBoxA
wsprintfA
CharNextA
LoadStringA
CharPrevA
MessageBoxExA

advapi32

GetSidLengthRequired
FreeSid
GetSecurityDescriptorDacl
RegEnumValueA
SetFileSecurityA
SetSecurityDescriptorDacl
GetSidSubAuthority
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
RegOpenKeyExA
RegCloseKey
InitializeSid
RegQueryValueExA
AllocateAndInitializeSid

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListA

Exports

Exports

xiupl

Sections

.text
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 476B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ