d1da8b46fa733f5931416da16c78bf95_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d1da8b46fa733f5931416da16c78bf95_JaffaCakes118
Size

3KB
MD5

d1da8b46fa733f5931416da16c78bf95
SHA1

bc944cb2372839afbdb0971737235f7067cda1b7
SHA256

d6925c8739c23bd57bc51f085b55b06ad16c3d4232f9ef0f884a9e4a6ac791cc
SHA512

5dd81635d1f119209ef61f10e27a0e77158f3e12b8507861714cf7a501d45bb498a22cba9b3d8a8f1ddfb503d49c4e53de14ba5f630be953719fd1315ce5b6cf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d1da8b46fa733f5931416da16c78bf95_JaffaCakes118

Files

d1da8b46fa733f5931416da16c78bf95_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b131604620b2ce1a5390878956121ed7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
wsprintfA

kernel32

CreateToolhelp32Snapshot
ExitProcess
GetCommandLineA
GetLastError
GetProcAddress
LoadLibraryA
CreateRemoteThread
Process32First
Process32Next
Sleep
SuspendThread
Thread32First
CreateProcessA
VirtualAllocEx
WriteProcessMemory
lstrlenA
CloseHandle
OpenProcess
Thread32Next

wsock32

connect
WSAStartup
recv
send
socket

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
RegSetValueExA
OpenProcessToken
RegOpenKeyExA

shell32

StrStrIA

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 256KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE