18e0562e1c8781d36c84494b2d2fbdd2_JaffaCakes118 | Triage

Sharing

General

Target

18e0562e1c8781d36c84494b2d2fbdd2_JaffaCakes118
Size

22KB
MD5

18e0562e1c8781d36c84494b2d2fbdd2
SHA1

4abf902f703030201ef62a24383dd7173fef4d0d
SHA256

6e384a2961d7e2d2cf5035e7a1c4898d7a05da53cc22455786aa390964ae2fc8
SHA512

9f683bc2eae3fbda91b76ff164765c6664513e439a31ba9b5f40e88e83ce4818e2fd8804a745c9ec57c4d1a13f9f4fd0272cd0fc96efcfe43251267a733378b9
SSDEEP

384:d9Gj4KelYLfWS4mW6NrzLenjGu7vMANpjsOWySNzLvqjUxdZ91PPq:dkuYACrzoTBpjsOgNRxd/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
18e0562e1c8781d36c84494b2d2fbdd2_JaffaCakes118

Files

18e0562e1c8781d36c84494b2d2fbdd2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fa8cb67828656f7a6ba8c84a3fb50b88

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

rtutils

TraceDumpExA

ntdll

NtAllocateVirtualMemory
RtlAdjustPrivilege
RtlAddAccessAllowedObjectAce
NtSetInformationObject

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE