8e316a02b6ae07759ea1ada7b0425ec6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8e316a02b6ae07759ea1ada7b0425ec6_JaffaCakes118
Size

4KB
MD5

8e316a02b6ae07759ea1ada7b0425ec6
SHA1

5241b6be85dc4fd1f19a4fc362d1f7cb1a1a6c76
SHA256

a8b83bd6984ea82b4f40df815fb6e84061b1e9dc4a5eac688af0adfd026459cc
SHA512

603aec854ece42b06f0df077ccff8cf112a1ee0eba221fd0cfbb4e14eb7274ce270a686ca8eafaf7b61122064a80f0114928fd9f26e68137de22d415207bc22f
SSDEEP

96:3rrDCfxjVzLkbB+npIbVnL1mDt9qszzNkta06f0VXtK:3f2pjZwVSuBLAhAst4+f01tK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e316a02b6ae07759ea1ada7b0425ec6_JaffaCakes118

Files

8e316a02b6ae07759ea1ada7b0425ec6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

48cd4d8ad95ffe2dabc9dc9f396f9036

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
TerminateProcess
SetThreadContext
WriteProcessMemory
lstrcatA
ResumeThread
GetThreadContext
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetEnvironmentVariableA
GetCurrentProcess
ExitProcess
CreateThread
CreateProcessA
VirtualAllocEx
CloseHandle

advapi32

OpenServiceA
OpenSCManagerA
OpenProcessToken
OpenEventLogA
LookupPrivilegeValueA
ControlService
CloseServiceHandle
CloseEventLog
ClearEventLogA
AdjustTokenPrivileges
QueryServiceStatus

user32

FindWindowExA
SendMessageA

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE