fa66dcc196eb9aafa5d31236c38c630c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fa66dcc196eb9aafa5d31236c38c630c_JaffaCakes118
Size

104KB
MD5

fa66dcc196eb9aafa5d31236c38c630c
SHA1

6072d680971f120581ccd17febe7fe5c9e8ef7b0
SHA256

69fa662870238afb8514cc876dd13aed18111be08718dbf75e7dabba2418c2ce
SHA512

ad040e24b543ae79df1582b8516c1ab15243eda266c335d837da1b0b39d84ec08260da9567b4951dc6841163b09308ae76a3935c1a8ad60f4c81a7e1d4c7bce1
SSDEEP

3072:SKD2qEdvvponOI2O/j8XQqGp7FzO8w0wekMJQv:SLRdvvpoOhG37z00

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa66dcc196eb9aafa5d31236c38c630c_JaffaCakes118

Files

fa66dcc196eb9aafa5d31236c38c630c_JaffaCakes118
.dll windows:4 windows x86 arch:x86

76617e1a081d29216f976c00e1630357

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

gubed.pdb

Imports

user32

MessageBoxA
wsprintfA
CharNextA
LoadStringA
CharPrevA
MessageBoxExA

advapi32

GetSidLengthRequired
FreeSid
GetSecurityDescriptorDacl
RegEnumValueA
SetFileSecurityA
SetSecurityDescriptorDacl
GetSidSubAuthority
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
RegOpenKeyExA
RegCloseKey
InitializeSid
RegQueryValueExA
AllocateAndInitializeSid

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListA

Exports

Exports

gmsdy

Sections

.text
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 486B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ