3d9db173d1027a90643ff24ef595938f_JaffaCakes118 | Triage

Sharing

General

Target

3d9db173d1027a90643ff24ef595938f_JaffaCakes118
Size

3KB
MD5

3d9db173d1027a90643ff24ef595938f
SHA1

317cec047a1c577f286218c12996bfe69da7dc59
SHA256

dea377661eb2e30d4fd637543d4b8159cf849a0911d96d629e9bfbace346f49e
SHA512

cddd82406c4a57cdb4f75f7b9db74eed6d9176ca2578414e74b86caa4c6140a352c2ba390fe75a576e6deb32391120fc733e8b36388b42ec23034b7072ece9ac

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3d9db173d1027a90643ff24ef595938f_JaffaCakes118

Files

3d9db173d1027a90643ff24ef595938f_JaffaCakes118
.dll windows:4 windows x86 arch:x86

844295c26b05e4e708be6cf3a5734e88

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

CreateProcessAsUserW
RegQueryValueExA
CreateProcessWithLogonW
RegOpenKeyExA
RegConnectRegistryW
ClearEventLogA

kernel32

Process32FirstW
GetCurrentThread
VirtualAlloc
WideCharToMultiByte
GetVersion
GetTempPathA

Sections

.text
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 26B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 42B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ