f1423aede41c7fd46122975f4e9e0d2d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f1423aede41c7fd46122975f4e9e0d2d_JaffaCakes118
Size

59KB
MD5

f1423aede41c7fd46122975f4e9e0d2d
SHA1

80eb8227f035545d8eedeb83dcd5efda7a68b2ff
SHA256

ea224a4cc920308be789017f72ffb6d5c79216db65b0991ddb672248755b0a28
SHA512

c910ccf945e8bcece908e2046e693b60f0637a574de3002d49178c7715d40cf50b7afc7861898762d1715cc00e7f4d6d1f5c4cce4a6eff3365b7c7122b752e3f
SSDEEP

1536:adRvDweKtQV9VB6sKdTFY2Wf2CQly4cMQazIzZpGi47w7ZYz:adRvDpxH6sKTL62J3cMH8bGiXGz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f1423aede41c7fd46122975f4e9e0d2d_JaffaCakes118

Files

f1423aede41c7fd46122975f4e9e0d2d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4808a001edaf0c137bc4e1df93759184

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ulib

?Construct@DSTRING@@AAEXXZ
?Stricmp@MBSTR@@SGHPAD0@Z
??4WSTRING@@QAEAAV0@ABV0@@Z
?Usage@PROGRAM@@UBEXXZ
?SkipWhite@WSTRING@@SGPAGPAG@Z
?IsGuidVolName@PATH@@QAEEXZ
??0BDSTRING@@QAE@XZ
?QueryChCount@WSTRING@@QBEKXZ

advapi32

InitializeAcl
RegDeleteValueW
EqualSid
QueryServiceConfigW
QueryServiceStatus
SetKernelObjectSecurity

ole32

CoRevokeMallocSpy
CoGetStdMarshalEx
CoTaskMemRealloc
CoRegisterMessageFilter
OleGetIconOfClass

msvcrt

_wctime
_controlfp
_wsplitpath
wcscat
exit
_ltoa

Sections

.text
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ