5d10cde863ef0bb7315e1b29486fdada_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5d10cde863ef0bb7315e1b29486fdada_JaffaCakes118
Size

24KB
MD5

5d10cde863ef0bb7315e1b29486fdada
SHA1

711a96d762209f856707f4a156ab79b27c08d5db
SHA256

bdaf6c591f226d4b473f3cec4ff84b00392449315fbd6b1d4358e99be396da2c
SHA512

3008d96c9553bf8bf92fc4ae1a90686d456f36d928b365a0759fd9c3b5688fa1ee5f58fab64d0464dc75464362b97c61dc78b0616b7864693da2c8d13e2877b7
SSDEEP

384:ulRLjGaDyDeHxRCDogW/8AoWFoByw2fcuzd3RI4CzT/jiBrUNWLhDEWb:efLDmwQDoqALGyncWFAjmRt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5d10cde863ef0bb7315e1b29486fdada_JaffaCakes118

Files

5d10cde863ef0bb7315e1b29486fdada_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fbea968907b0cce9de4993f692c2c4b4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenProcess
MapViewOfFile
CreateFileMappingA
GetFileSize
UnmapViewOfFile
WinExec
GetTempFileNameA
GetTempPathA
Sleep
CreateFileA
GetProcAddress
LoadLibraryA
GetPrivateProfileStringA
ExitProcess
WritePrivateProfileStringA
GetModuleFileNameA
GetWindowsDirectoryA
FreeLibrary
GetLastError
DuplicateHandle
GetCurrentProcess
GetSystemDirectoryA
CloseHandle
LCMapStringA
WideCharToMultiByte
RtlUnwind
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringW

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

shlwapi

PathAppendA

Sections

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ