8537f2608a6ec812ea52748d22c69550_JaffaCakes118 | Triage

Sharing

General

Target

8537f2608a6ec812ea52748d22c69550_JaffaCakes118
Size

5KB
MD5

8537f2608a6ec812ea52748d22c69550
SHA1

7037407a77d009201a11629791b16de3938cdb71
SHA256

5adbbb6809c4efdf39597086f3dca4d4a682a3ce7a1fb9b764de137f80fa80bb
SHA512

fd7f91345ce18b36cd2e4caa083a22e5472d9605b916f8c9698b89f005c3e6119e416766a2832d5e3909c40dade0451de3e87abe82026d650dbbb4b4aaa5fa98
SSDEEP

48:q+hpNMKLXrK/5N5Ov0yAAr7nvxMxN0HvxC2g9zs5ybl4T617P7iL8zlJeQYZgFZB:Ph+Rc00JMxN0Hrg945U17DlrYcdkjem

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8537f2608a6ec812ea52748d22c69550_JaffaCakes118

Files

8537f2608a6ec812ea52748d22c69550_JaffaCakes118
.dll windows:4 windows x86 arch:x86

e8afd97b133e0e7c65e9911116da314b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcessId
WriteProcessMemory
GetCurrentProcess
CreateRemoteThread
VirtualAllocEx
CloseHandle
Module32FirstW
Process32NextW
CreateToolhelp32Snapshot
Module32NextW
GetModuleHandleA
GetProcAddress
GetModuleFileNameW
ReadProcessMemory
OpenProcess
Process32FirstW
GetModuleHandleW

user32

CharLowerBuffW

advapi32

LookupPrivilegeValueW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
AdjustTokenPrivileges
OpenProcessToken

shell32

Shell_NotifyIconA

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ