549e146f05689557f68ed2e980b47ae7_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

549e146f05689557f68ed2e980b47ae7_JaffaCakes118
Size

169KB
MD5

549e146f05689557f68ed2e980b47ae7
SHA1

9a1c696e862d849593030b866c40ed3138ee87bb
SHA256

e3e3d7866558226c118b6ada16d107fff660d30b43cf5de5f509508a7dd1c73f
SHA512

a55a03f4dd0eaca53db35d432f5fb02f9f3c113eb4e4a8da6cdcb352fae16efc739963ecc7a72cb97b1bcee3742ef6edd74705dd107c3eda7e8295197ceac18b
SSDEEP

3072:f16EOTnZc5YH1X9fQ3jxAYg4E8bcAwOVfXoLRsvUC:f16EOTnZc5YbfQ3KXp8bIOBYLRsvUC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
549e146f05689557f68ed2e980b47ae7_JaffaCakes118

Files

549e146f05689557f68ed2e980b47ae7_JaffaCakes118
.dll windows:4 windows x86 arch:x86

5eddc451a8fd7e00eb4731d356a3225e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

RegisterWindowMessageW
DefWindowProcA
IsWindow
RegisterClassA
CharLowerW
DestroyWindow
UnregisterClassA
CharNextW
SetWindowPos
GetWindowLongW
PostMessageA
SetWindowLongW
MoveWindow
LoadStringA

advapi32

InitializeSecurityDescriptor
IsValidSecurityDescriptor
GetFileSecurityA
InitializeAcl
RegEnumKeyExW
GetTokenInformation
GetSecurityDescriptorDacl
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegQueryInfoKeyW
SetSecurityDescriptorDacl
GetAclInformation
RegCloseKey
GetLengthSid
AddAccessAllowedAce
RegEnumValueW
OpenProcessToken
GetAce
RegDeleteKeyW
CopySid

Exports

Exports

juRirLyiE

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 103KB - Virtual size: 423KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ