2f7c918ea4c5358ac103ab4834a7a8d6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2f7c918ea4c5358ac103ab4834a7a8d6_JaffaCakes118
Size

3KB
MD5

2f7c918ea4c5358ac103ab4834a7a8d6
SHA1

3f7f934a41c744a7a5f3b0ad21641016edd488a7
SHA256

02bb3173f30de834e2b70cb3c0d5f9d81050976a2c4e71e4aa33689ee007c149
SHA512

4025994c63f427b714bea0e66f19a75262334c3441f17fa7fa94139a5b251d3b9c2b81f3b489dfabf9d08f157f6fed6e6ab0e156070cc98e1fb5935a2ba62912

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f7c918ea4c5358ac103ab4834a7a8d6_JaffaCakes118

Files

2f7c918ea4c5358ac103ab4834a7a8d6_JaffaCakes118
.dll windows:4 windows x86 arch:x86

5d67ca2286452ee6c1a6d95cd09ea0b2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcessHeap
Sleep
GetLastError
lstrcmpiW
CreateMutexA
CloseHandle
CreateThread
HeapFree
lstrcpynW
GetProcAddress
VirtualAlloc
GetModuleHandleA
VirtualProtect
WriteProcessMemory
GetCurrentProcess
HeapAlloc
ReadProcessMemory

user32

SetWindowsHookExA
CallNextHookEx

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ