fd0526dea42abca3cecab75b68a355b6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fd0526dea42abca3cecab75b68a355b6_JaffaCakes118
Size

772KB
MD5

fd0526dea42abca3cecab75b68a355b6
SHA1

f5a0ea5299798c147e39dfe36443b1f1339778e9
SHA256

7fb41396916c19816c17a3e35fde862c1bd7074775b41311d2d8f7c6e3b6d4d1
SHA512

753a8e6dbd77f429746bf1de34c17e5fedd96f859d39ae5d1d561331d2709b206d33246a6d1e67a81434286a6fba6512f8e7ae4d4299adc0953d2550d41f1adf
SSDEEP

12288:zl5iWB0lVsqpcg+jzXmrWDx9oMCqWOlZ70T+u3B8k7+X2vf5a:xIlOqOXXmrE9LVoh+14U

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fd0526dea42abca3cecab75b68a355b6_JaffaCakes118

Files

fd0526dea42abca3cecab75b68a355b6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

226c853fcb707db5d844782b578b4636

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CreateEventA
HeapCreate
GetTickCount
DeleteFileA
SetConsoleCP
VirtualQuery
GetCommandLineA
SetEvent
GetTimeFormatA
SuspendThread
GetModuleFileNameW
LocalFlags
CloseHandle
Sleep
ReleaseMutex
OpenMutexA
GetStartupInfoA
lstrlenW
GetModuleHandleA

advapi32

IsTextUnicode
RegQueryValueW
IsValidSecurityDescriptor
IsValidAcl
RegEnumKeyA
RegCreateKeyExW
CreateServiceW
RegDeleteValueA
IsValidSid
ControlService
InitializeSid
ClearEventLogW
CreateProcessAsUserA

msvcirt

??0Iostream_init@@QAE@XZ
??0Iostream_init@@QAE@XZ
??0Iostream_init@@QAE@XZ
??0Iostream_init@@QAE@XZ

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 763KB - Virtual size: 763KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ