f5f7245c93bb3b58b02d88760074fc15_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f5f7245c93bb3b58b02d88760074fc15_JaffaCakes118
Size

45KB
MD5

f5f7245c93bb3b58b02d88760074fc15
SHA1

5095facccc5b903f32bcfed13a6978225d44ab98
SHA256

c236e9c2d2e2e2d476edffd545a7812812787e4dfd18bbdc552fe7965bb61f8d
SHA512

00f60d3334909749b12e3fa1b8b17e11007779337ccc690d09ac705cd243238994c27702fbfbe8bf892955ae8f585ebe9cdc232fc5563af4bc6ccf8b22bc0512
SSDEEP

768:6czeljoJTrzdmAQomprdixSuuCQZiFbLgvdikNxgBy+R36lQkF:6erzdmAfqrdixLuC9Ud/i9R36lQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f5f7245c93bb3b58b02d88760074fc15_JaffaCakes118

Files

f5f7245c93bb3b58b02d88760074fc15_JaffaCakes118
.dll windows:4 windows x86 arch:x86

f6595c5a195a774b5a098aa8c869af03

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

AdjustTokenGroups
CryptSetHashParam
DeleteAce
CloseEventLog
CryptGetHashParam
DuplicateToken

kernel32

WinExec
ExitProcess
TerminateThread

msvcrt

_eof
_chkesp
_ctype
_except_handler2
_CItanh

Sections

.text
Size: 28KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE