6255f8dc07bf6537c14c071ca90fa364_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6255f8dc07bf6537c14c071ca90fa364_JaffaCakes118
Size

43KB
MD5

6255f8dc07bf6537c14c071ca90fa364
SHA1

e51fa9e18819fd740a864dd41a794fb7c7393930
SHA256

03a24f225c8760fd8199c03482c439c85aaa10c6d33b59feb834d675ec7079e3
SHA512

580b3a44d5ff1549b92b4c2cd2c10b2f93114fcca881c288e5a51ac131d8de50bf1713e7e983d2891381ccb2a1c78ee645c95d8ac2eaaca4981000f6b3cfd785
SSDEEP

768:5av5vSjtHTsEbqIYoHZtXl9H3WXSKVLhYIiBf2kiV9iTFRO6O0SJ0slg2Q:cxvShHTsK/JuVdYVBfKeO6dSvlg3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6255f8dc07bf6537c14c071ca90fa364_JaffaCakes118

Files

6255f8dc07bf6537c14c071ca90fa364_JaffaCakes118
.dll windows:4 windows x86 arch:x86

096d78266a405b7224a4733bd9fe54c7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

RtlWriteRegistryValue
ZwLoadDriver
RtlAdjustPrivilege
ZwOpenEvent
_stricmp
strrchr
RtlImageNtHeader
RtlCreateRegistryKey

kernel32

CreateFileA
MultiByteToWideChar
GetModuleFileNameA
LoadLibraryExA
GetModuleHandleA
VirtualProtect
FreeLibrary
SetEvent
CloseHandle
CreateThread
SetFilePointer
WriteFile

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 440B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ