ac6907aef239b90dab4d6a5a143d85a9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ac6907aef239b90dab4d6a5a143d85a9_JaffaCakes118
Size

54KB
MD5

ac6907aef239b90dab4d6a5a143d85a9
SHA1

c104644551f96568500043b16569faf0c29ea08c
SHA256

c60ace7b12c1adfe339cb0594cdc5cc1fbf84409ecddab5dd03a72c6ece75a24
SHA512

a26dab2d90d43d942460bbb4b974d1464012e26c4db729918f975254cf45ae12ff656f82b4d77b357595b5accd9969b2701aa6602177fd8022cd91523cb3d5e9
SSDEEP

1536:qWpn+RfMQuoCQ0Iu7EsrL78Dw90vD8HCXWI5pey0c:7n+Rx8/ss3wG0vYH80y0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ac6907aef239b90dab4d6a5a143d85a9_JaffaCakes118

Files

ac6907aef239b90dab4d6a5a143d85a9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

72bfcc534eebf294033077f767897718

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
ExitProcess
GetProcAddress
SizeofResource
SetHandleCount
LoadResource
GetModuleFileNameA
GetSystemDirectoryA
CloseHandle
GetCurrentProcess
FreeLibrary
LoadLibraryA
_lcreat
_lwrite
FindResourceA
_lclose

user32

wsprintfA

advapi32

LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges

msvcrt

fseek
strlen
strcat
fclose
fwrite
fopen
rename
sprintf
strcpy
fputc
memset
fread

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 890B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ