de8798b0a9087c9c55522773af28873e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

de8798b0a9087c9c55522773af28873e_JaffaCakes118
Size

32KB
MD5

de8798b0a9087c9c55522773af28873e
SHA1

e385a383ca9ba73e039eeb42b993a717dd516755
SHA256

20207c76a7206cc5b8a817175c0fc2f016d95d92a160ecfcb6f7b4e2d94d375c
SHA512

9e2520ec8fabc842778f746488729f3d9b2f9af932c888bf895de9449a23d92d1a169bbea3882513db6f774c352ecd9eb01e48ec11ca6f45ed7f200bc20d3602
SSDEEP

768:lFim/ZATN/Ui+NgDQ4jBLi1AFO5BRz/Moi8:KoilUta9EnT28

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
de8798b0a9087c9c55522773af28873e_JaffaCakes118

Files

de8798b0a9087c9c55522773af28873e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6d8d483ffb59d70c11d98cc87cba736a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

AdjustTokenPrivileges
BackupEventLogW
CryptAcquireContextW
CryptDuplicateKey
CryptVerifySignatureA

kernel32

ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect

user32

DispatchMessageW
GetDlgItem
GetForegroundWindow
GetKeyboardLayout
LoadCursorW

Sections

.itext
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 696B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 19KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rel
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE