3386d4518f671c1dcd13f9797fe85b6b_JaffaCakes118 | Triage

Sharing

General

Target

3386d4518f671c1dcd13f9797fe85b6b_JaffaCakes118
Size

45KB
MD5

3386d4518f671c1dcd13f9797fe85b6b
SHA1

781a89866eafacacc81c4b68aeb626d02ddabfce
SHA256

46ce910c69bba96207764a2f1e106b0691059e186f386492829cca4aef792bc1
SHA512

ede2e2b1d7a8823d8a9b2b12e5d58e1ead7b1d9cd05fe4ad8c05526aba297f1bb1bbe53921645ddaaf295828f9af64268fb39ee70cac8f2adaa2b18116af13f1
SSDEEP

768:fjTOV5BlRWXKpIcPg3kaKry3QL//ucGoK6FI38o9c9U1QjRhz9HqvJckxeG:mv4XKpIuIkfLnkCnEfwN9qh3MG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3386d4518f671c1dcd13f9797fe85b6b_JaffaCakes118

Files

3386d4518f671c1dcd13f9797fe85b6b_JaffaCakes118
.dll windows:4 windows x86 arch:x86

f6595c5a195a774b5a098aa8c869af03

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

AdjustTokenGroups
CryptSetHashParam
DeleteAce
CloseEventLog
CryptGetHashParam
DuplicateToken

kernel32

WinExec
ExitProcess
TerminateThread

msvcrt

_eof
_chkesp
_ctype
_except_handler2
_CItanh

Sections

.text
Size: 28KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE