2ae16fff10aa7c64b1b150dc7c831af2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2ae16fff10aa7c64b1b150dc7c831af2_JaffaCakes118
Size

3KB
MD5

2ae16fff10aa7c64b1b150dc7c831af2
SHA1

c18814a2fa89302e7a3304eb1e6911173c340bcb
SHA256

4beb51fd0fc5ea517e2e899eccb7f8e4cb79e77ca80c6e7eaac92ef23522da63
SHA512

9d46155b1ea536ffea62283a4e001a324b034c9252e7bb6921ad5a5532b1bc2e449d81512633fe7d707b18a6cc36593d03ee05ffc476a2c82d1d39594b02c1e8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ae16fff10aa7c64b1b150dc7c831af2_JaffaCakes118

Files

2ae16fff10aa7c64b1b150dc7c831af2_JaffaCakes118
.dll windows:4 windows x86 arch:x86

5d67ca2286452ee6c1a6d95cd09ea0b2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcessHeap
Sleep
GetLastError
lstrcmpiW
CreateMutexA
CloseHandle
CreateThread
HeapFree
lstrcpynW
GetProcAddress
VirtualAlloc
GetModuleHandleA
VirtualProtect
WriteProcessMemory
GetCurrentProcess
HeapAlloc
ReadProcessMemory

user32

SetWindowsHookExA
CallNextHookEx

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ