01461b739db7e592464f31c86c22f25c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

01461b739db7e592464f31c86c22f25c_JaffaCakes118
Size

137KB
MD5

01461b739db7e592464f31c86c22f25c
SHA1

033a3a3b00114e50b276fb811d3ccc9f35687d5f
SHA256

5d421d94d065472a4e17803ea969a8d4aa061bf865f04a978acb47351f6fcfbb
SHA512

79f9065452f7091f6271ea8065e0d79b3f3c3cbb482adbf69a89488712fa3f8ff2c909bb66779a126dc5aeffb4dd63b9f24dd373a58db2503e5e9bc7a034356f
SSDEEP

1536:VG19u/Hf5W574cb9DAMAoD6QAjVGDhqIUSQ63LgEVNzdDvZDehP7FsFckHmKu7:cju/HhW5scK+AhIhqTST3LgE/dDZSK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01461b739db7e592464f31c86c22f25c_JaffaCakes118

Files

01461b739db7e592464f31c86c22f25c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

3d0212002d2b886d5a9b5129a3e4fa82

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetWindowsDirectoryA
HeapAlloc
GetProcessHeap
HeapReAlloc
HeapFree
WritePrivateProfileStringA
SetCurrentDirectoryA
lstrlenA
GetSystemTimeAsFileTime
RtlUnwind
InterlockedExchange
VirtualQuery
GetFullPathNameA
GetFileAttributesA
GetLastError
CreateFileA
WriteFile
CloseHandle
WinExec

user32

wvsprintfA

advapi32

StartServiceA
CloseServiceHandle
CreateServiceA
EnumServicesStatusA
OpenSCManagerA

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 726B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ