eb8e5b99b77b4d9da755990a3403d50d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

eb8e5b99b77b4d9da755990a3403d50d_JaffaCakes118
Size

48KB
MD5

eb8e5b99b77b4d9da755990a3403d50d
SHA1

e2a0a10b7040308229ab37babed27aacd3d4b438
SHA256

a7d7885fbc9dc3e17b23cffd8a30a6538c71a45b9c9c55f09d1c6659ef5cfcbf
SHA512

793fad6215724ebcfb12467156feb8b60a675bc32cd46036e27147e1cbaebd80ce624a671649ed74b3e801393c0887ef1bafbd989afe1881bd6d2b5d91b0d83c
SSDEEP

384:CfnxygagVhvwUMdphtHG4SAyveFiTQBWwSN7tUOkIcj2:Cfxyga4Qd3q7TQBWCO1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eb8e5b99b77b4d9da755990a3403d50d_JaffaCakes118

Files

eb8e5b99b77b4d9da755990a3403d50d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

36dce34ed1f42515c7d0ed663aae538a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
GetProcessHeap
GetSystemDirectoryA
GetTempPathA
HeapAlloc
HeapFree
GetCurrentProcess
LockResource
SizeofResource
WriteFile
lstrcatA
lstrcpyA
lstrlenA
FindResourceA
ExitProcess
DeleteFileA
CreateFileA
LoadResource
CloseHandle

advapi32

RegOpenKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegRestoreKeyA

shell32

ShellExecuteA

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 836B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ