d568dd428f37978c70dc9a2f72257f85_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d568dd428f37978c70dc9a2f72257f85_JaffaCakes118
Size

19KB
MD5

d568dd428f37978c70dc9a2f72257f85
SHA1

002decc88888f15e593d9663a1f62778188bdbd8
SHA256

0fc547eab4c27ce6c7931f7530c1eb51f221ead27854a681c12be8cec2967d68
SHA512

7db2fd5f36b4f8fd749580f620c787f5e32af1a2974fab4a75c3be2f078a4a26c0253cc55d3a835312899a6b445bb0e518029bd8dfed03bd484b8c44646a355b
SSDEEP

192:Ga2s/Hv7QpjLJRYkoPuanGwySNlfsyGIWba0BkbBUFcigu:G9s/v7QpZRYkVSNPGIWba0B8UFcXu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d568dd428f37978c70dc9a2f72257f85_JaffaCakes118

Files

d568dd428f37978c70dc9a2f72257f85_JaffaCakes118
.exe windows:4 windows x86 arch:x86

64b04312e71fb79cde44f2cd2f128b9c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
GetModuleHandleA
ExitProcess
CloseHandle
FreeLibrary
VirtualProtect
LoadLibraryA
GetProcAddress

advapi32

AreAllAccessesGranted

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ