f9c48a99ada2d27d8e1c14703eccfcdd_JaffaCakes118 | Triage

Sharing

General

Target

f9c48a99ada2d27d8e1c14703eccfcdd_JaffaCakes118
Size

7KB
MD5

f9c48a99ada2d27d8e1c14703eccfcdd
SHA1

4b2de616dc3c1afdc2896d051a33b4f0d64a9abb
SHA256

bfbbf33f4e08023343498974478587577d6da145273ddd32c6ccc3b93ce81293
SHA512

4e3d45b955f350897935e8c351e2508ee560c9a4b6cc741316586f2b06071bf8cc9e80fc95a6838b1c2d9ad88861e44329df983a170b2d7a8e7ca7ddad51afd1
SSDEEP

192:kaLZOYMBGG2hcKWWEVtH6nnVcOwbHicTj2P49H:k2Op0cKcOn7cPT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f9c48a99ada2d27d8e1c14703eccfcdd_JaffaCakes118

Files

f9c48a99ada2d27d8e1c14703eccfcdd_JaffaCakes118
.exe windows:1 windows x86 arch:x86

aa57ab958c5dfd47adbac79d9c490f1f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

ExitWindowsEx

kernel32

CloseHandle
CreateFileA
DeleteFileA
ExitProcess
GetModuleFileNameA
GetModuleHandleA
GetTempPathA
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
ReadFile
Sleep
WriteFile
lstrcatA
lstrlenA

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegOpenKeyExA
RegSetValueExA

Sections

.data
Size: 512B - Virtual size: 1B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.code
Size: 1024B - Virtual size: 933B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE