66f0f0f9cc5229541d87795970afe194_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

66f0f0f9cc5229541d87795970afe194_JaffaCakes118
Size

115KB
MD5

66f0f0f9cc5229541d87795970afe194
SHA1

b92f4a196b7a300cd814798409d1deb86a62a757
SHA256

b13713dd472209efcafea1906f28ea12ed7ecd5a53d1f654d373d65a458d0063
SHA512

7f91844ecf16a90bd2f34461389f69af7f91aa16d335393f5bf833f7c89d5efa512f6baa9c0ae8270f31a4c257f57891a6879ca7624308b934b74b424356f02c
SSDEEP

1536:pwoaSr8C0bw+xPXTrHNjIRvy8IzDVginpiS3iNn:y3Sh9M/9IBSDVgypLW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
66f0f0f9cc5229541d87795970afe194_JaffaCakes118

Files

66f0f0f9cc5229541d87795970afe194_JaffaCakes118
.exe windows:5 windows x86 arch:x86

85c50f6201d10100d46783478656e74f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

advapi32

RegCloseKey

wtsapi32

WTSFreeMemory

userenv

CreateEnvironmentBlock

updateserviceproxy

??0UpdateServiceProxyStub@DPI@@QAE@XZ

uuid

??1UUId@@QAE@XZ

logger

?getDefaultInstance@Logger@@SAPAV1@XZ

configurationmanager

?getDefaultInstance@ConfigurationManager@@SAPAV1@ABW4Scope@1@@Z

msvcr90

exit

msvcp90

??1locale@std@@QAE@XZ

Sections

.MPRESS1
Size: 48KB - Virtual size: 256KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE