5df9a43479f3e6e2281798b705f756f7_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5df9a43479f3e6e2281798b705f756f7_JaffaCakes118
Size

51KB
MD5

5df9a43479f3e6e2281798b705f756f7
SHA1

c07cb7b235eaa2089b9824fd1388137aa5d292e4
SHA256

8d7497a7fad51c2e04abbf09c475b521d5c94925a40cecdc7be21fd4bb265be3
SHA512

53d2aaec80d6ac59000ffb298b8543ebff70a958c0841b11e4de56f96bd175cdc9f0162656a6e0638e32bb84b406dd24d91c966d46d8fa7ff6e98ca1862b0d30
SSDEEP

768:4y+/KjOmwZL0qmOcMxHnaFBCO4u9m//8OpplBMtewJjQKgJPqoki+pomoC1F3Y91:1+/mUAqmbIHOCOF5jXhQKgBqyCfY9/x/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5df9a43479f3e6e2281798b705f756f7_JaffaCakes118

Files

5df9a43479f3e6e2281798b705f756f7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

29c0298e811f453b1d4e3dde3251c8a9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetNamedPipeInfo
GetPrivateProfileSectionNamesW
GetSystemDefaultLCID
OpenProfileUserMapping
OpenWaitableTimerA
SignalObjectAndWait
WriteProcessMemory

advapi32

BuildImpersonateExplicitAccessWithNameW
DeleteAce
LookupPrivilegeNameW
MapGenericMask
QueryServiceStatus
RegDeleteKeyA
RegOpenKeyExA
SetServiceStatus

gdi32

CreateFontA
CreateRectRgnIndirect
EndDoc
EnumEnhMetaFile
FlattenPath
GetBoundsRect
GetCharWidth32W
GetCharacterPlacementW
GetClipBox
GetMapMode
GetPolyFillMode
PolyDraw
RemoveFontResourceW
SetICMMode
SetRectRgn

Sections

.text
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 50KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE