dc983e1cb48d85981942d822f91ebc0b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dc983e1cb48d85981942d822f91ebc0b_JaffaCakes118
Size

7KB
MD5

dc983e1cb48d85981942d822f91ebc0b
SHA1

ccbfa96d7b013952851a802c0c6db5b953eb7710
SHA256

9a858173fbf41dc47aafdb65c36b30a1f48b5e0d13b2fd8af87d1e41ab69a433
SHA512

cae157e9c13540ef2a821cf15cd71663136b9dfdfd676579edb283650d47681344d2150e7327620b89382f960804bcdbe6820b2b5348a91b94505790980e8e97
SSDEEP

96:htC21FMW354JtZHy2arB12yMrSNxLP8k2ofHZVyBqAPNC2cdSB:51FMW35cRsYVrSNxLPyBq0cg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dc983e1cb48d85981942d822f91ebc0b_JaffaCakes118

Files

dc983e1cb48d85981942d822f91ebc0b_JaffaCakes118
.dll windows:4 windows x86 arch:x86

e5737eb5fd74d419148ad1236c6fc5ea

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges

ntdll

ZwQuerySystemInformation
strtoul
memcpy
RtlInitAnsiString
LdrGetProcedureAddress
NtQueryInformationProcess

kernel32

CreateThread
GlobalAddAtomA
GetCurrentProcessId
GlobalFindAtomA
Sleep
GlobalDeleteAtom
WinExec
VirtualFree
CloseHandle
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
VirtualAlloc
lstrcpyA
lstrlenA
GetSystemDirectoryA
LoadLibraryA
GetModuleHandleA
LocalFree
LocalReAlloc
LocalSize
LocalAlloc
WriteFile
CreateFileA
DuplicateHandle
OpenProcess
GetLastError
CreateRemoteThread

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 382B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ