006df0d5482ce3bec49d5faf6c9bfa69_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

006df0d5482ce3bec49d5faf6c9bfa69_JaffaCakes118
Size

36KB
MD5

006df0d5482ce3bec49d5faf6c9bfa69
SHA1

ced891b33e25d95a4d7f625edb54fd69184e6809
SHA256

c77b7cf4103e4f5d68e2f03c2df7affb568ac4842077c7d4f30540cf6d41ba12
SHA512

884294a1c6c3a44fd1bccb23f36910c6a767df6817bd44f3b00d05a4270a9319661c4227490f24b3d0eef49ea40576e6c861db0b0a161907fd0e17c6e107ecf2
SSDEEP

96:TF0MgAr71nxY9AAIvqZ2ZNHHE4oynLKcm5OzG38U6p2WL4P4oyn:iJaPLjC2ZNHk4oynLKL38jp2VP4oyn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
006df0d5482ce3bec49d5faf6c9bfa69_JaffaCakes118

Files

006df0d5482ce3bec49d5faf6c9bfa69_JaffaCakes118
.exe windows:4 windows x86 arch:x86

36d48c3828d9cbf53c30779d29945791

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr100

GetProcAddress
LoadLibraryA
WinExec
WriteFile
CreateFileA
SizeofResource
CreateRemoteThread
FindResourceA
GetModuleHandleA
GetWindowsDirectoryA
MoveFileA
GetTempPathA
GetCurrentProcess
OpenProcess
CloseHandle
LoadResource

advapi32

OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
_snprintf
_exit
_XcptFilter
exit
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_stricmp

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 978B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 332B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ