d342fd20fda301d5b73f4c6fd1868d1f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d342fd20fda301d5b73f4c6fd1868d1f_JaffaCakes118
Size

45KB
MD5

d342fd20fda301d5b73f4c6fd1868d1f
SHA1

26dcc3716bff005b3b7d618b1924666950ff69c1
SHA256

648f6b606cd78cdff46428953d228ea5442972341e1af4232f47f1497b6b587a
SHA512

3c7d2e1336d88b7c7abca116ec0d9fc4a6a4a196ff95096750a535aec69dbad916c6627f20b5f970912bcd7aee8ba9db4c9a755091e6b85de0dc8e47c956263e
SSDEEP

768:Luq1y8OVfJRFokz88/5+X0U35g19ZnNrTtfRKpv2GAAWB/GnLpbvngrinhAl0D:Luq1y8OJP+t8235IZnNbm2GAJtZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d342fd20fda301d5b73f4c6fd1868d1f_JaffaCakes118

Files

d342fd20fda301d5b73f4c6fd1868d1f_JaffaCakes118
.dll windows:4 windows x86 arch:x86

f6595c5a195a774b5a098aa8c869af03

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

AdjustTokenGroups
CryptSetHashParam
DeleteAce
CloseEventLog
CryptGetHashParam
DuplicateToken

kernel32

WinExec
ExitProcess
TerminateThread

msvcrt

_eof
_chkesp
_ctype
_except_handler2
_CItanh

Sections

.text
Size: 28KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE