29dae1f843e54dab7abc0c86124e0067_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

29dae1f843e54dab7abc0c86124e0067_JaffaCakes118
Size

7KB
MD5

29dae1f843e54dab7abc0c86124e0067
SHA1

bbbae70ec33fa45d0d51b6da21731092f2272302
SHA256

e0ec5f71ab5912d01b4cf248c8d97f7f30221628a2faed83778e27d18cd34b31
SHA512

bee9938a6664aa4c50b5a8a88749f2efa40e75105e091259912fd14a594a5a489326d3e0667dff818ad942385086aacf875d83f32e3c226673ec85737ba4d4c7
SSDEEP

96:aVreS/EHX2ABNb+C5eks/JbrBm56PC4M7BsX14y2uuHf5bD:aYS/Y2AbbteksRxtPpd52usfFD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29dae1f843e54dab7abc0c86124e0067_JaffaCakes118

Files

29dae1f843e54dab7abc0c86124e0067_JaffaCakes118
.dll windows:4 windows x86 arch:x86

9e9c3cd40cfde60a5ef25370948364f9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ReadProcessMemory
GlobalFree
GlobalLock
GlobalAlloc
GetCurrentProcess
GetModuleFileNameA
VirtualProtectEx
CreateThread
Sleep
WideCharToMultiByte
GetPrivateProfileStringA
WriteProcessMemory
CloseHandle

user32

UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
wsprintfA

advapi32

AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA

wininet

InternetOpenA
InternetOpenUrlA
InternetCloseHandle

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sdata
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 454B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ