a736f7b3ad703454fb28ceeaf24e2880_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a736f7b3ad703454fb28ceeaf24e2880_JaffaCakes118
Size

21KB
MD5

a736f7b3ad703454fb28ceeaf24e2880
SHA1

978af0422734b65438e24d36920a7bb1ecc411d7
SHA256

87a41942bbd956573c7d633597172a2651f06a427c7f91c036b8565c869f3205
SHA512

461c8ee8055bec52b4a3a265f4e6a4e0b574d866e673d70dca5e3d9d9dd8cdca613598229d91a155507b68a21ac61d600bf42d6ab9acb9091c596c1309db3c81
SSDEEP

384:mKA4Dwm312IIe/khIFaaZnwiMPaiyEs7dIk+LRanF:W84CshcaeNiyhxKg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a736f7b3ad703454fb28ceeaf24e2880_JaffaCakes118

Files

a736f7b3ad703454fb28ceeaf24e2880_JaffaCakes118
.dll windows:4 windows x86 arch:x86

2939019b3e1c9516282f24ae4f08a1e6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WinExec
ExitProcess
TerminateThread

msvcrt

_eof
_chkesp
_ctype
_except_handler2
_CItanh

advapi32

CloseEventLog
CryptGetHashParam
AdjustTokenGroups
CryptSetHashParam
DeleteAce
DuplicateToken

Sections

.text
Size: 8KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARDAT
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE