0e0fa3033c7484bf499dbdc8b328b213_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0e0fa3033c7484bf499dbdc8b328b213_JaffaCakes118
Size

9KB
MD5

0e0fa3033c7484bf499dbdc8b328b213
SHA1

d9b64e318224940cb49079d7097443df636c75df
SHA256

cdb84ede17e52dbd136536fcfbb44ffeb05147207a369344eb2f2caaed608aaf
SHA512

d170ccae37db37d402de73407510c98a1cb484e85a22acfc93d9d6384c4f90a1657976c359330c332b8a0e6226b001c7fea7f6b807ab2a91b7bf660e7be1b5f5
SSDEEP

192:lEXvET6BRPnHnMQXs8inXiimNJWH1qNc/FdlS:l6vET6zPnHMtpH1qNcNdlS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e0fa3033c7484bf499dbdc8b328b213_JaffaCakes118

Files

0e0fa3033c7484bf499dbdc8b328b213_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0336d4f3e823dd48cee4654969d2b445

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
OpenProcess
Process32First
GetProcAddress
GetModuleHandleA
CreateToolhelp32Snapshot
GlobalFree
WriteFile
VirtualAllocEx
GetSystemDirectoryA
GlobalAlloc
ReadFile
SetFilePointer
GetFileSize
CreateFileA
GetModuleFileNameA
Process32Next
GetCurrentProcess
lstrcatA
CloseHandle

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

Sections

.text
Size: 1024B - Virtual size: 770B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ