0b284fbb6bc6c0116dd9c3b58d7f96b9_JaffaCakes118 | Triage

Sharing

General

Target

0b284fbb6bc6c0116dd9c3b58d7f96b9_JaffaCakes118
Size

14KB
MD5

0b284fbb6bc6c0116dd9c3b58d7f96b9
SHA1

f238545fef754ff032f494c294abd095ae9de057
SHA256

c0c00a5de6df092e0f498995d375235a9ae8e353406c067e463dc752a9de8f72
SHA512

d321891283ce5b6ce859c9821019956ec705803c8e611430cb27a19d4a89ee538dc92d0216d363fffccbc6d018ffcdd8cfa9a380ae02d9dfac33db7fa097bb7e
SSDEEP

192:C5Xb3ZBuQXQ0CTou3NIQHIrQXkaM2DV/Zyzw0m1N:C5XbJ4QVuou9F+r1YZyE0QN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b284fbb6bc6c0116dd9c3b58d7f96b9_JaffaCakes118

Files

0b284fbb6bc6c0116dd9c3b58d7f96b9_JaffaCakes118
.dll windows:4 windows x86 arch:x86

dfbd983805d40876ee4635890be5d7f2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ReadProcessMemory
GlobalFree
GlobalLock
GlobalAlloc
GetCurrentProcess
GetModuleFileNameA
VirtualProtectEx
GetPrivateProfileStringA
WideCharToMultiByte
CreateThread
WriteProcessMemory
CloseHandle

user32

UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
wsprintfA

advapi32

AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA

wininet

InternetOpenUrlA
InternetOpenA
InternetCloseHandle

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sdata
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 548B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ