424ccc38ddcd5465d38a1b4f6dc89a30_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

424ccc38ddcd5465d38a1b4f6dc89a30_JaffaCakes118
Size

656KB
MD5

424ccc38ddcd5465d38a1b4f6dc89a30
SHA1

eb6836fd5f43419eaf51039be33a055f396e785d
SHA256

d2efff5d7412be35b96381771df19c6edef62039d106b2159cccc1e9ef7391ad
SHA512

d3518c44241073f95350efd0c3be1c7f8e75150968162da04888a2450e698003d65353ebe21c87478aace4016c0f676267e9f28650b738795be0f717c43f5f08
SSDEEP

12288:1965DKQqMi7IBL+VPNgSySxCQe9jh1B7t77:j6FKQ/6VCL9V1N57

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
424ccc38ddcd5465d38a1b4f6dc89a30_JaffaCakes118

Files

424ccc38ddcd5465d38a1b4f6dc89a30_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1e916bcdf39b62f3d81f191cb1eef774

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rtutils

TraceDumpExA

ntdll

RtlAddAccessAllowedObjectAce
RtlAdjustPrivilege
NtAllocateVirtualMemory

kernel32

FormatMessageW
GetLastError

ole32

CoInitializeEx
CoCreateInstance
CoUninitialize

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 608KB - Virtual size: 608KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE