adb87cfe5a4bbacd138638ee1872f015_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

adb87cfe5a4bbacd138638ee1872f015_JaffaCakes118
Size

38KB
MD5

adb87cfe5a4bbacd138638ee1872f015
SHA1

454a1a53fc516efa107429191600a145e1222c74
SHA256

686b395fc4f47105d039992e7573a121d943a45c1891f17b4b135598f80e507e
SHA512

c0fd12244f0d5a6039bd8a40d6e5f4957a4a622f4ab3549593ac3c9065a298d07254736d719b4f4d00ee143a8b7447fc7475db2cc2fa846a88a8fdf432466ec1
SSDEEP

768:5MaprheTzCWZWgtnPXdbGGeroz/8tpOGy92G03Mms:uakqWAGecgtMB92B3Mm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
adb87cfe5a4bbacd138638ee1872f015_JaffaCakes118

Files

adb87cfe5a4bbacd138638ee1872f015_JaffaCakes118
.dll windows:4 windows x86 arch:x86

096d78266a405b7224a4733bd9fe54c7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

RtlWriteRegistryValue
ZwLoadDriver
RtlAdjustPrivilege
ZwOpenEvent
_stricmp
strrchr
RtlImageNtHeader
RtlCreateRegistryKey

kernel32

CreateFileA
MultiByteToWideChar
GetModuleFileNameA
LoadLibraryExA
GetModuleHandleA
VirtualProtect
FreeLibrary
SetEvent
CloseHandle
CreateThread
SetFilePointer
WriteFile

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 416B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ