3a0ff8a19976231289e86b902ed3897d_JaffaCakes118 | Triage

Sharing

General

Target

3a0ff8a19976231289e86b902ed3897d_JaffaCakes118
Size

4KB
MD5

3a0ff8a19976231289e86b902ed3897d
SHA1

22c7877fb5184d6033cbdf3c5a8c36bc2411e4af
SHA256

86c3f045b996cc2976b87397480dc29043be2eddf3efba2840428c512c4b9361
SHA512

e7d22c09ec37ed1f4b5f75f87215198b3cdb2880e1d0eb9a56e96c77b99a3299b0892d5beaf119390f31d67dd8110cd17d4006abe07817c0a7122ea98b7abced
SSDEEP

96:RjGFqoKJQ6E10frjF+2EbKJlNfYhrl+BECko:Rj6+dg6x4KLNfWU24

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3a0ff8a19976231289e86b902ed3897d_JaffaCakes118

Files

3a0ff8a19976231289e86b902ed3897d_JaffaCakes118
.dll windows:4 windows x86 arch:x86

a01d028c2fd4ed73c466d69d75c298d7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateToolhelp32Snapshot
GetCurrentProcess
GetCurrentProcessId
GetModuleHandleA
GetProcAddress
MapViewOfFile
CreateFileMappingA
Module32Next
OpenFileMappingA
UnmapViewOfFile
VirtualProtectEx
WriteProcessMemory
lstrcmpiA
Module32First
CloseHandle

user32

SetWindowsHookExA
GetWindowThreadProcessId

imagehlp

ImageDirectoryEntryToData

Exports

Exports

HideProcess

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 732B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 236B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ