f521dbd9f3e4e306118be4bfcb59f770_JaffaCakes118 | Triage

Sharing

General

Target

f521dbd9f3e4e306118be4bfcb59f770_JaffaCakes118
Size

9KB
MD5

f521dbd9f3e4e306118be4bfcb59f770
SHA1

0c0e65e69faea71d1153ef767071955f58b4d00c
SHA256

75f09e87d6cd946bc55825f2d23ed471b59938770e4dbf2aa0907012b08cadc5
SHA512

05876cb27447307f6450653a8e274e6314381a393664c51f201d41f822de445fc9619bc59d16a46d6d51c6cc5dd549580e450a74ffbf4b023a1640584585d566
SSDEEP

192:+kpkEMkyuFN4BLaP1oyn1FT7TIoqv1S2m:/kEMknFN4xk1TFLIoqtt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f521dbd9f3e4e306118be4bfcb59f770_JaffaCakes118

Files

f521dbd9f3e4e306118be4bfcb59f770_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f870244fb786d934c2fdb00c67d1eed4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges

msvcrt

tolower
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
strstr

kernel32

WriteProcessMemory
VirtualAllocEx
GetModuleHandleA
GetStartupInfoA
GetSystemDirectoryA
lstrcatA
GetModuleFileNameA
BeginUpdateResourceA
FindResourceA
LoadResource
LockResource
SizeofResource
CreateFileA
WriteFile
CloseHandle
EndUpdateResourceA
GetCurrentProcess
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
GetVersionExA
GetProcAddress
LoadLibraryA
OpenProcess
CreateToolhelp32Snapshot
Process32Next
Process32First
Sleep

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ