c90a9a24cd50038207817ead3fbfa9d9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c90a9a24cd50038207817ead3fbfa9d9_JaffaCakes118
Size

28KB
MD5

c90a9a24cd50038207817ead3fbfa9d9
SHA1

2af7e2a59a8459ff7d9676c5d8b6ff12841b34e9
SHA256

4ec081eccd3006e0a9ab00f6ff93933e61c19459ab2a302073a28fe7f1320dfd
SHA512

670b8c2a4b0b3202818b65852de8ad3f11f43f8469892a0aa51628c601964758548c4af74d3587e9c7baa66a114b59f2b8de03ecdc1fad54edad84902a24bf97
SSDEEP

192:ef3DmIDDb2w3mgfpWEG+4iZrHKUy7HSF6yITLc+A5OrnbI:e92eQEG+tD4HSDYAVgrM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c90a9a24cd50038207817ead3fbfa9d9_JaffaCakes118

Files

c90a9a24cd50038207817ead3fbfa9d9_JaffaCakes118
.dll windows:4 windows x86 arch:x86

a2899c58857df9d3325d3a11de97a270

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WideCharToMultiByte
OpenProcess
FlushInstructionCache
WriteProcessMemory
GetModuleHandleA
VirtualAllocEx
ReadProcessMemory
GetVersionExA
FreeLibrary
GetCurrentProcess
LoadLibraryA
GetLastError
CloseHandle
GetProcAddress

advapi32

OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges

msvcrt

memcpy
??2@YAPAXI@Z
_except_handler3
_local_unwind2
strcpy
memset
_mbsicmp
free
_initterm
malloc
_adjust_fdiv

psapi

GetModuleBaseNameA
EnumProcessModules
GetModuleInformation

shlwapi

SHGetValueA

Exports

Exports

DllInstall

Sections

.text
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 524B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ