0e3f125509158462f330f63d74898468_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0e3f125509158462f330f63d74898468_JaffaCakes118
Size

37KB
MD5

0e3f125509158462f330f63d74898468
SHA1

cf9001d36eb09187521c3c5de204d76febf6a993
SHA256

06f88d6d5dff6d936c5a1b1cce2f8f4446a57aef77675587f758d250a627b856
SHA512

e6766d68c4ee684001018bb8d074594a899f0b7cfe446a02ce446405bdc3a9a69d41fcc36c7b150323c89e55a1d53f43bbb522c4b13c4cdd37f1cc77218c2d1b
SSDEEP

768:B3UH19MiWINVyTzE1uQjA5gHS2GNtRX3DugxYX6HRqscTfwn0b:B3819MiWc9jQgHS2GNjDuJecbwnQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e3f125509158462f330f63d74898468_JaffaCakes118

Files

0e3f125509158462f330f63d74898468_JaffaCakes118
.exe windows:4 windows x86 arch:x86

493fadfe59ec1ccb667d3415d5357692

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
LoadLibraryA
lstrlenA
GetCurrentProcess
GetProcAddress
lstrcmpiA
CloseHandle

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

Sections

.text
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

SCRYPT
Size: 75B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

SCRYPT
Size: 93B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

pvksejex
Size: 18KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

0eek340o
Size: 4KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE