56c2132c736d2eda2815cd57710a240f_JaffaCakes118 | Triage

Sharing

General

Target

56c2132c736d2eda2815cd57710a240f_JaffaCakes118
Size

3KB
MD5

56c2132c736d2eda2815cd57710a240f
SHA1

2b20f776adbb4cc1edf9b6f942063014e556ea10
SHA256

426085eb0331e900aafa904a3a973cee2aa951897991557f9022e66e9d2b7a22
SHA512

14ee3eee5ad8d39d0000ea62b184e33d2aa340354d56e9e4400bc2f93320d82cb64ae31e21141fd6a8c9ea8a72762159cf53b573981ac1ec93799d37e46b1161

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
56c2132c736d2eda2815cd57710a240f_JaffaCakes118

Files

56c2132c736d2eda2815cd57710a240f_JaffaCakes118
.dll windows:4 windows x86 arch:x86

363e148e47669fdff479f13e9fe6ef1f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegEnumKeyExA
RegQueryValueExA
CreateProcessAsUserW
RegOpenKeyExA
RegNotifyChangeKeyValue
RegDeleteKeyA

kernel32

CreateMutexW
FindResourceExW
VirtualAlloc
GetFullPathNameA
GetVersion
WaitForSingleObject

Sections

.text
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 428B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 26B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 42B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ