0c098ca6abdb40468fc4165239d6e386_JaffaCakes118

General

Target

0c098ca6abdb40468fc4165239d6e386_JaffaCakes118
Size

106KB
MD5

0c098ca6abdb40468fc4165239d6e386
SHA1

4dbdecdf5bd571b46604fb0e330ff5387476d01d
SHA256

5dc75dcf46e08b693a2cc84e7f6325011e53f0d0fcdb1f34927d42c3f9310f8c
SHA512

7974c5b2756796e2bed26ef5e0eb7e60b4b61041785c25cfba912e696064140a4f359a0312251135be3e4586970d937e8aa3238d873a36b6a3026a2214b013f9
SSDEEP

1536:VlXX5EfNoRb7Kh+rjNu0A98FyK2GA3QY7tFyHgsQVDV3fkKfw2OoQNzkOZv:D58Si+rjNu0K8F9nAAknkKfw2FQNz1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c098ca6abdb40468fc4165239d6e386_JaffaCakes118

Files

0c098ca6abdb40468fc4165239d6e386_JaffaCakes118
.exe windows:5 windows x86 arch:x86

5a7c0bf6768d75e7c76c92df1ac7f9a0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempPathW
GetLastError
Process32FirstW
LockResource
Process32NextW
lstrcmpiW
lstrcatW
lstrlenW
CloseHandle
DeleteFileW
GetCurrentProcessId
lstrcpyW
GetModuleHandleA
CreateFileW
TerminateProcess
GetStartupInfoA
SizeofResource
Sleep
GetSystemDirectoryW
OpenProcess
WriteFile
CreateDirectoryW
CreateProcessW
LoadResource
CreateToolhelp32Snapshot
FindResourceW

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_exit
malloc
_XcptFilter
memset
memcpy

advapi32

CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
StartServiceW
RegDeleteValueW
RegOpenKeyExW
ControlService
RegCloseKey
RegSetValueExW
CloseServiceHandle

Exports

Exports

strdup

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 684B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5a7c0bf6768d75e7c76c92df1ac7f9a0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

advapi32

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 2KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 176B

.rsrc Size: 99KB - Virtual size: 98KB

.reloc Size: 1024B - Virtual size: 684B

.text
Size: 2KB - Virtual size: 2KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 176B

.rsrc
Size: 99KB - Virtual size: 98KB

.reloc
Size: 1024B - Virtual size: 684B