3b7027e763d0c20b7e212ec90664033b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3b7027e763d0c20b7e212ec90664033b_JaffaCakes118
Size

56KB
MD5

3b7027e763d0c20b7e212ec90664033b
SHA1

815d5184264f2bbc0fa36833362c2ca7a3b4fc42
SHA256

38a43344d27e7932c6526c94ddcf9fc2a113da2ed0c65f834a4b3726d075b3c9
SHA512

23b5579a34135458a0d6bb5460261b37993d01a6510bf52e0c225d7ada44dde04de8385246d44fde309663d49c64c7b2204524a2ce48e8947703e896a95af5a3
SSDEEP

768:5WxsJ4fTwBsGE4KGx3FyuhD1WhWN7bFbfWDpegv3uis+qF1tuRepfxF2US:5bu7wPE4P+2WhYbf6Qgv+IWtmepaUS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b7027e763d0c20b7e212ec90664033b_JaffaCakes118

Files

3b7027e763d0c20b7e212ec90664033b_JaffaCakes118
.dll windows:4 windows x86 arch:x86

1c2d42a4e533f3c86f1f4597355c880c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

AdjustTokenGroups
CloseEventLog
CryptGetHashParam
CryptSetHashParam
DeleteAce
DuplicateToken

kernel32

WinExec
ExitProcess
TerminateThread

msvcrt

_chkesp
_ctype
_eof
_except_handler2
_CIacos

Exports

Exports

GetKey

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE