c928e92030095b7830b3073ae60641b9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c928e92030095b7830b3073ae60641b9_JaffaCakes118
Size

26KB
MD5

c928e92030095b7830b3073ae60641b9
SHA1

beedce8aae26d026faf281a0b77b0dd24f84a781
SHA256

af4552013eef0c3ef10e54a6ad39efa9d4e347c67c0b585ac044f612c37ea215
SHA512

d09ce2884a69f2776566a5b621cffbc985252d09ca1855f80e87345351969e2c1b91490c8be65c07563f933704db34e2a8360077f336f43fb643afc2444b4bc3
SSDEEP

384:5Wwdubrzun9h+4EjiHg/pRIAZL4uZZDb8uTwbpbR3xM4mk2NtlfjPQU6v7dnh7Gc:zdubavEjmqL4uZZ/FT23DQNt9jnAdFz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c928e92030095b7830b3073ae60641b9_JaffaCakes118

Files

c928e92030095b7830b3073ae60641b9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

85566519d78ab954d3a6bd5d12e75d2f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

strstr
_itoa
sprintf
_stricmp
_chkstk
memset

psapi

EnumProcessModules
GetModuleBaseNameA
EnumProcesses

kernel32

DeleteFileA
CloseHandle
GetModuleHandleA
GetModuleFileNameA
GetExitCodeThread
LoadLibraryA
ExitProcess
CreateFileA
GetCurrentProcess
WaitForSingleObject
GetTickCount
ExpandEnvironmentStringsA
CreateRemoteThread
WriteFile
OpenProcess
VirtualAllocEx
Sleep
ReadFile
GetSystemDirectoryA
SetCurrentDirectoryA
GetLastError
GetProcAddress
VirtualFreeEx

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE