3f5c177a0a449e3153baaac4e43a1ace_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3f5c177a0a449e3153baaac4e43a1ace_JaffaCakes118
Size

3KB
MD5

3f5c177a0a449e3153baaac4e43a1ace
SHA1

2639afbc187637653763b4ff0ecb8081b8d6bb16
SHA256

bcdce9a773a4676338b02d57006c3a60e5bf378e26dd8e5d77d57cbc508f563f
SHA512

a9ed9877ed8d3e5f2f50d991206a735fb176b54bc606c6babb91d14f94ee4afebec4a87445920a4cfc59da58d750cb26f680c4510d04512bebb1e52bbea16b55

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3f5c177a0a449e3153baaac4e43a1ace_JaffaCakes118

Files

3f5c177a0a449e3153baaac4e43a1ace_JaffaCakes118
.dll windows:4 windows x86 arch:x86

5d67ca2286452ee6c1a6d95cd09ea0b2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcessHeap
Sleep
GetLastError
lstrcmpiW
CreateMutexA
CloseHandle
CreateThread
HeapFree
lstrcpynW
GetProcAddress
VirtualAlloc
GetModuleHandleA
VirtualProtect
WriteProcessMemory
GetCurrentProcess
HeapAlloc
ReadProcessMemory

user32

SetWindowsHookExA
CallNextHookEx

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ