110fb1b8e90b8025a3840cde9d254e71_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

110fb1b8e90b8025a3840cde9d254e71_JaffaCakes118
Size

23KB
MD5

110fb1b8e90b8025a3840cde9d254e71
SHA1

e980d1af78bdb5bdba358f47fb3f13a03abccdab
SHA256

e44ba22da25725578b68f8abcd277c82f5ffb1b1d8a72fc43f9b537bd81d0c69
SHA512

f60b9826f0552463b808a9ae7842d67ba0c6f11b9e35c38bb7622084b3cbd3525dcb4bef2068f57ffc25768805508ae4100ee51b7ba3a7dccb894f5b43a57d80
SSDEEP

384:j2Aiz7ppRyXeSvyhwt5CW/8AoWwj1v1hkNLdbaLa4CwUJuUCSFCJWe8EDEWW:aTpRSlOwt5oAuJv7wbaLa4PU48IM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
110fb1b8e90b8025a3840cde9d254e71_JaffaCakes118

Files

110fb1b8e90b8025a3840cde9d254e71_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f6efd8020654e3bf28b6c173ddfb3b4c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenProcess
MapViewOfFile
CreateFileMappingA
GetFileSize
UnmapViewOfFile
WinExec
GetTempFileNameA
GetTempPathA
Sleep
GetSystemDirectoryA
CreateFileA
LoadLibraryA
GetPrivateProfileStringA
ExitProcess
WritePrivateProfileStringA
GetModuleFileNameA
GetWindowsDirectoryA
FreeLibrary
GetLastError
CopyFileA
DuplicateHandle
GetCurrentProcess
GetProcAddress
CloseHandle
LCMapStringA
WideCharToMultiByte
RtlUnwind
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringW

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

shlwapi

PathAppendA

Sections

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ