de369817accc123a84ef2198aa69b185_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

de369817accc123a84ef2198aa69b185_JaffaCakes118
Size

22KB
MD5

de369817accc123a84ef2198aa69b185
SHA1

ef3ca4a911f3adfb7f456417227fbde0d7036187
SHA256

43b843df5f991a2a31fb13e0638729083b5acca06e743983246e69e2be85a693
SHA512

8522ba84b83476ac33a10d66947723709bf018b3fa7f6bf34f83d06569b971fd775dce56ae300e8d2da6dd56245078b3fc10b66b614a69f8b70ac831dfe44386
SSDEEP

384:ghfGDQkzHM7iG920ZhcifR/pQKsj/chYSFz+cbCg4X4ou6NgYbXWDDWVsn:ZHa7LHR/p5sjUhYNc2G+Ng8ATn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
de369817accc123a84ef2198aa69b185_JaffaCakes118

Files

de369817accc123a84ef2198aa69b185_JaffaCakes118
.dll windows:4 windows x86 arch:x86

18627ae854889350ab3beafd824f6551

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiA
Process32First
CreateToolhelp32Snapshot
OpenProcess
WaitForSingleObject
CreateRemoteThread
FreeLibrary
GetProcAddress
LoadLibraryA
GetVersion
WriteProcessMemory
VirtualAllocEx
Process32Next
ReadProcessMemory
VirtualProtectEx
VirtualProtect
GetModuleHandleA
DeleteFileA
lstrlenA
GetSystemDirectoryA
GetModuleFileNameA
HeapAlloc
GetProcessHeap
HeapFree
lstrcpyA
GetCurrentProcess
CloseHandle

advapi32

LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 980B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ