e0a76926c1a6ef3487a576c54ec314ac_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e0a76926c1a6ef3487a576c54ec314ac_JaffaCakes118
Size

624KB
MD5

e0a76926c1a6ef3487a576c54ec314ac
SHA1

312b08632628464b3366689cbf94fe39eb7a10d1
SHA256

e0e510269ca807483db01c0650d112c73671ca75f8981edd6505683024fc773c
SHA512

ed209651573ecf0174a64fbe8b5c31745c4ba751a8d568615b352d14c0241ac6e9bc36bc9b45ad81adb431b87cfbd7464170d24ff78296dcc85433e2012350e3
SSDEEP

12288:KzHGSJ3dZV80BVBZi73FENOGLNOQhpO2CH42DxMsscRC:KLJtVTa71iOiTb0dDx9R

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e0a76926c1a6ef3487a576c54ec314ac_JaffaCakes118

Files

e0a76926c1a6ef3487a576c54ec314ac_JaffaCakes118
.dll windows:4 windows x86 arch:x86

09c9eae57c32288b06583721a7a80bd8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

advapi32

DeleteAce
AdjustTokenGroups
CloseEventLog
CryptGetHashParam
CryptSetHashParam
DuplicateToken

kernel32

LocalFileTimeToFileTime
MultiByteToWideChar
RaiseException
HeapReAlloc
InterlockedDecrement
SetFileTime
ExitProcess
MulDiv
GetModuleHandleW

Sections

CODE
Size: 532KB - Virtual size: 532KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE