ff1c54d70aebed934257df1fce18a940_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ff1c54d70aebed934257df1fce18a940_JaffaCakes118
Size

19KB
MD5

ff1c54d70aebed934257df1fce18a940
SHA1

2d08c1d0aa3c531e262b14345f1c4a78db98eae9
SHA256

8c6877b6e2bbf7d7b080c7ff69b21819aeaf153e7cc482abcefd0b8ceb32d0a3
SHA512

708e9906edb4abbf099807821a5a1b4e4329e898fc7b7b47914f2cb6cadf64e16cbd83fb896867369a168413829455001a919a33130c82f7381323378aef773e
SSDEEP

192:p7LlK0b00GZY6Wpo5rXPjtetGQoE/yLPkdoKnatPiq2P0x5Dgw/KR9pgaJacKAit:pNVGZXf/VPsoKnaBacxKw/sgrt1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff1c54d70aebed934257df1fce18a940_JaffaCakes118

Files

ff1c54d70aebed934257df1fce18a940_JaffaCakes118
.exe windows:4 windows x86 arch:x86

493fadfe59ec1ccb667d3415d5357692

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
LoadLibraryA
lstrlenA
GetCurrentProcess
GetProcAddress
lstrcmpiA
CloseHandle

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 358B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE