304960418ebd6a67b22d2b07c32eaf8f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

304960418ebd6a67b22d2b07c32eaf8f_JaffaCakes118
Size

12KB
MD5

304960418ebd6a67b22d2b07c32eaf8f
SHA1

42ac0795c436b379592e71573320e2543e3f5c75
SHA256

ad1df228f8eb72027b4ae675c2936f55dec4604d0d0815a38587621f3688b61b
SHA512

729a3a928c51f284cd904976cb93239360e728634759b7bb160e08e23078ca20f135a60638fe2a35f0155db7b88540aa70933b874edb7870eb16fb82a539b29e
SSDEEP

192:C58r33iuoUY6o0+p3sprQXk4XWyZuyzbm1w/Dvb:C58r2z6zg4rK8yvQw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
304960418ebd6a67b22d2b07c32eaf8f_JaffaCakes118

Files

304960418ebd6a67b22d2b07c32eaf8f_JaffaCakes118
.dll windows:4 windows x86 arch:x86

dfbd983805d40876ee4635890be5d7f2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ReadProcessMemory
GlobalFree
GlobalLock
GlobalAlloc
GetCurrentProcess
GetModuleFileNameA
VirtualProtectEx
GetPrivateProfileStringA
WideCharToMultiByte
CreateThread
WriteProcessMemory
CloseHandle

user32

UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
wsprintfA

advapi32

AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA

wininet

InternetOpenUrlA
InternetOpenA
InternetCloseHandle

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sdata
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 594B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ