d5de1044a70008f5e602df4851144a42_JaffaCakes118 | Triage

Sharing

General

Target

d5de1044a70008f5e602df4851144a42_JaffaCakes118
Size

313KB
MD5

d5de1044a70008f5e602df4851144a42
SHA1

6aa27af2581751af6de41c772428a9273c969176
SHA256

8070e9f6db70ee0d8837a6081ee08531cd90547b6a15737f645b8a09e24cd214
SHA512

e93e2811f69767f0a05e6197d047a639937fa127893f72b8bad74760299c374d7f298130ff6b8e1b8deca45294d4c04023a2d4ae59990200ed1b9cfcf344e0d7
SSDEEP

6144:HBmC+Q+qcXhZ/kTUURcrrlAbVcmrOREkYoUy0EWoUZIAqIzB:HqQkXhgUprrlAIX7hYZ2Iz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d5de1044a70008f5e602df4851144a42_JaffaCakes118

Files

d5de1044a70008f5e602df4851144a42_JaffaCakes118
.exe windows:4 windows x86 arch:x86

897cd5b0aebfb14bb40692c6b53c83b1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OutputDebugStringA
TlsGetValue
IsValidCodePage
HeapReAlloc
WriteConsoleW
LCMapStringW
GetStringTypeA
EnumSystemLanguageGroupsW
OutputDebugStringW
DebugBreak
LCMapStringA
GetLocaleInfoA
GetTimeZoneInformation
CompareFileTime
GetStringTypeW
GetCPInfo

oleacc

CreateStdAccessibleObject
ObjectFromLresult

oledlg

OleUIBusyW

shell32

SHChangeNotify
SHGetMalloc
SHGetPathFromIDListW

advapi32

SetSecurityDescriptorOwner
GetUserNameA
IsValidSecurityDescriptor
GetSecurityDescriptorLength
DuplicateTokenEx
QueryServiceStatus
LookupAccountSidA
PrivilegeCheck
InitializeSecurityDescriptor
AddAce
RegOpenKeyExW

winmm

sndPlaySoundA

Sections

.text
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 213KB - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ