37d6a53c947a15dce6533a6a8db22a30_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

37d6a53c947a15dce6533a6a8db22a30_JaffaCakes118
Size

55KB
MD5

37d6a53c947a15dce6533a6a8db22a30
SHA1

c26814531574a39d9328dc14b6f350a67e25feb5
SHA256

66f58bd8f0d8bde2eaa862e27d5ce7255009ab92280367aea9c74ca98b0644fb
SHA512

ce7d2e56b49c66908d23eb61e3e5b50c7a5554b1c69749d0e22b256d18fb806e803997668da195cf0386c1fc56f7683ab8919738a0dfccca784f6f9d181b03fe
SSDEEP

768:BHO8uMhJlLSxZCf6l3R9h+j4LrbM9sTU6+JJD:BEf/LHM9NJJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
37d6a53c947a15dce6533a6a8db22a30_JaffaCakes118

Files

37d6a53c947a15dce6533a6a8db22a30_JaffaCakes118
.exe windows:4 windows x86 arch:x86

127534f2dbacfc87e2296a8ad83b9e3e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges

user32

LoadIconA
SendMessageA
EndDialog
DialogBoxParamA
wsprintfA
SetDlgItemInt
GetDlgItemInt
MessageBoxA

kernel32

lstrlenA
lstrcpyA
WriteProcessMemory
WriteFile
VirtualAllocEx
Sleep
SetProcessWorkingSetSize
RtlZeroMemory
CloseHandle
CreateFileA
CreateProcessA
CreateRemoteThread
CreateThread
ExitProcess
FlushInstructionCache
FreeLibrary
GetCurrentProcess
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
LoadLibraryA
OpenProcess
ReadFile

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ