29a75c96a348531c82912da3f07f19ec_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

29a75c96a348531c82912da3f07f19ec_JaffaCakes118
Size

346KB
MD5

29a75c96a348531c82912da3f07f19ec
SHA1

7f4126d779a8581a399daee44bdca9ce3be4fc53
SHA256

b4a478dc516f5f4808c6c87e81f87a850bfc123e124158ee0af09b2036e36c43
SHA512

1cd5935b9ca03373d7b2afa7e85e096e414c4503f18c40f4f12ee23602b8bbfbde54b565e0e2095cc57b1cad624bf7c850cadaff92ea6a94ec829841b98181ba
SSDEEP

6144:bUJX1g0Q+b70RXX51pI+VyRQiQm5F+2AjmahG/eDbFqn+x:bsB7KXXpMQXEF+2HSG/H+x

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29a75c96a348531c82912da3f07f19ec_JaffaCakes118

Files

29a75c96a348531c82912da3f07f19ec_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f9a832c95b599480e17d7b38c47012b9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetModuleHandleA
LockResource
LoadResource
SizeofResource
GetProcAddress
GetModuleFileNameA
CreateMutexA
OpenMutexA
GetStartupInfoA
GetCurrentProcess
CloseHandle
FindResourceA
CreateFileA

user32

MessageBoxA

advapi32

OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA

msvcrt

__getmainargs
strcat
memset
malloc
strlen
_except_handler3
_exit
_XcptFilter
exit
_acmdln
printf
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 532B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 340KB - Virtual size: 340KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ