ae4d21ec1099cb2e1dc15bc204a62e01_JaffaCakes118 | Triage

Sharing

General

Target

ae4d21ec1099cb2e1dc15bc204a62e01_JaffaCakes118
Size

10KB
MD5

ae4d21ec1099cb2e1dc15bc204a62e01
SHA1

8b54dd70d651ee03f6fcd8e1f3f747587ba9024b
SHA256

408640b3e296d59181a17662ce09249ebf5e1eee2deb68e1cf498fcd18a3bbc0
SHA512

d3e87e80d49da302f20d7169e076aeec335a0fc6030cdcb3b472f9a7672b7d3e20a2896f0d1e626abc5b5653a993380608ed9f8faa00dd5dceee6af4a61becd1
SSDEEP

192:jtfD2xXiONIRqtYUC/V1b5XPtyxsyvXBrapZLhGFRtSkL8f6:lyxSL8tI9Visy5+pQL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ae4d21ec1099cb2e1dc15bc204a62e01_JaffaCakes118

Files

ae4d21ec1099cb2e1dc15bc204a62e01_JaffaCakes118
.dll windows:4 windows x86 arch:x86

1e28e8f679e4d06e22a8f6be79584980

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapAlloc
GetProcessHeap
VirtualProtect
GetTickCount
Sleep
HeapFree
CloseHandle
CreateFileA
CompareStringA
lstrlenA
WideCharToMultiByte
MultiByteToWideChar
CreateThread
ReadFile
GetFileSize
GetModuleFileNameA
IsBadReadPtr
GetCurrentProcess
GetCurrentProcessId

user32

wsprintfA
CallNextHookEx
TranslateMessage
DispatchMessageA
GetMessageA
SetWindowsHookExA

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

wininet

InternetCloseHandle
InternetReadFile
InternetOpenUrlA
InternetOpenA

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 704B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ