020946431b2b29c8924e26bfed34fd35_JaffaCakes118 | Triage

Sharing

General

Target

020946431b2b29c8924e26bfed34fd35_JaffaCakes118
Size

5KB
MD5

020946431b2b29c8924e26bfed34fd35
SHA1

d3a1f7f7cba18fd08acad1b5f02f862c61c4aaf5
SHA256

9f7080cf32e9aa4c54f601f2e28c1e1c2705d87c06770693958906520d797508
SHA512

97c22374e5c39a7dbb9547d9a68fb2941b00dcf4ad77936965af021ccaba74e91b35432da623a65b99478f9a2e6d5b30a9b2853a230fad289d0f99ce20a6d9d5
SSDEEP

48:6ibR5PHQX1R6Th3IPVduHLCPAJQKwHKzM2E3QWSRl0QJd:bR5PwXL6VIPVwHLCPASHHJrSRSQJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
020946431b2b29c8924e26bfed34fd35_JaffaCakes118

Files

020946431b2b29c8924e26bfed34fd35_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ae16514607f72416acb2e10f43ffd048

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

LookupPrivilegeValueW
OpenProcessToken
AdjustTokenPrivileges

msvcrt

_initterm
__setusermatherr
_adjust_fdiv
__getmainargs
__p__fmode
__set_app_type
_except_handler3
_controlfp
__p___initenv
exit
_XcptFilter
_exit
sscanf
printf
__p__commode

kernel32

GetVersion
GetCurrentProcess
CloseHandle
GetModuleHandleW
GetProcAddress
GetLastError

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.WYCao
Size: 718B - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ