2699db673d8416d1790d94f7b28d673a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2699db673d8416d1790d94f7b28d673a_JaffaCakes118
Size

8KB
MD5

2699db673d8416d1790d94f7b28d673a
SHA1

204c9172f4c09eabf4d1dc202aaa54647c476745
SHA256

24064d9d08a026e0667c0c8816ec0d96a3fe839913cfb5dcc0df6af86ca2c41b
SHA512

e1b954d8176e002a17198f8655ead24071aa841e52c6cabef2bc475be9b459ad9f57f06767d30b6141c8d1e2f4ee3b9c560648482552b47e240de133f264d9a0
SSDEEP

48:6Z8C4iaZScr1xmDq1qcBeXhxrgz3AVpYSEuERpCaiHn8+97mopEz:LiavfmSYLC68+Y6Ez

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2699db673d8416d1790d94f7b28d673a_JaffaCakes118

Files

2699db673d8416d1790d94f7b28d673a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

29d7cdc11ea8691a1777fe24ff9f9fc4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateRemoteThread
GetModuleHandleA
GetProcAddress
GetStartupInfoA
MapViewOfFile
OpenProcess
ExitProcess
GetCurrentProcess
CloseHandle
WaitForSingleObject
WriteProcessMemory
lstrcpyA
lstrlenA
CreateFileMappingA
VirtualAllocEx
UnmapViewOfFile
VirtualFreeEx

user32

GetWindowThreadProcessId
FindWindowA

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

Sections

.text
Size: 1024B - Virtual size: 878B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 532B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE