0880bc53a038a0f74ed195552220b4dc_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0880bc53a038a0f74ed195552220b4dc_JaffaCakes118
Size

10KB
MD5

0880bc53a038a0f74ed195552220b4dc
SHA1

166b0129a9a938d708c46c57b689a3f4916eed64
SHA256

2d26089b6f9758defef1d7607e38e73fdc63b6776ca406a21e2982ea28facaf2
SHA512

5d0f7c82a3105f6ac9aa1c79595616a1be89c3512d41485f2901f2e1cef648a235d1d16fcb31cdf3f28ebbaa45b4646d2c3caaf195379a4f9fc52b68e05c48e4
SSDEEP

96:yc1rqC4RquUqCLm8KlTckBcf0hKMqizJqk8LpywX1ifQo9:vrqvqucLm8KrcchKMqid8LpywX0fQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0880bc53a038a0f74ed195552220b4dc_JaffaCakes118

Files

0880bc53a038a0f74ed195552220b4dc_JaffaCakes118
.exe windows:4 windows x86 arch:x86

91b2790c505bbe69e215e722d884b1b4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

crtdll

sprintf

kernel32

CreateProcessA
GlobalAddAtomA
GlobalFindAtomA
GetVersion
GetTempPathA
GetTickCount
ExitProcess
GetModuleFileNameA
CopyFileA
Sleep
CloseHandle
GetModuleHandleA
GetCurrentProcess
CreateFileA
ReadFile
SetFilePointer
WriteFile
GetFileSize
GlobalAlloc
DeleteFileA

user32

ExitWindowsEx

shell32

ShellExecuteA

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

!eprot
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ