af036986af7c14b63a4bd28fc68fec27_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

af036986af7c14b63a4bd28fc68fec27_JaffaCakes118
Size

45KB
MD5

af036986af7c14b63a4bd28fc68fec27
SHA1

96457df1639badf02224f1af752f41f13f2a90bf
SHA256

4becc03dfb66c04fe6cdccd403c09b69bf649c32dd765a4762357c43431cc437
SHA512

685c2dcd5c8732ec2270e85af48871d4c315a471c675c3dcab9d87c957627aa0e6c19b8064b91a18e4f061af6da273ac4b1d9ca918e455dc1e3bc5b50fc8936e
SSDEEP

768:2I37gbBR1NJnq82GhrEEhFEythZj4hhW6HZUWHt/5wECZYvO0doJkg:FgNJqQhXhFEyrZjSzHqx4W0doD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af036986af7c14b63a4bd28fc68fec27_JaffaCakes118

Files

af036986af7c14b63a4bd28fc68fec27_JaffaCakes118
.dll windows:4 windows x86 arch:x86

f6595c5a195a774b5a098aa8c869af03

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

AdjustTokenGroups
CryptSetHashParam
DeleteAce
CloseEventLog
CryptGetHashParam
DuplicateToken

kernel32

WinExec
ExitProcess
TerminateThread

msvcrt

_eof
_chkesp
_ctype
_except_handler2
_CItanh

Sections

.text
Size: 28KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE