168afdee233c0ce1788398b7c2fe373b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

168afdee233c0ce1788398b7c2fe373b_JaffaCakes118
Size

23KB
MD5

168afdee233c0ce1788398b7c2fe373b
SHA1

6836c6207e0a80d1738dde2d806ad0932b2bff26
SHA256

b5086669a60c9180b9814b576a24e365209b0b7a8b805bcb2db87cbeccde244d
SHA512

32a97c7846ba87fe08e60122cc4b25650ad2908e51a7c1210c3dd9b64eb90553b41801fd32e10b3ea048c1ea712cbeada3711707c450ba7de6afd373c26ac2d9
SSDEEP

192:LTovVET+uE5/MPCbRzLYbEyEG1e/QSZ02VZ8ad3Brv1DZvB72jbKotwSQ3v5skj9:LToEikqbR3h+epZXVJrTJuwSaCkDtB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
168afdee233c0ce1788398b7c2fe373b_JaffaCakes118

Files

168afdee233c0ce1788398b7c2fe373b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d1c1e7d060c4288fba55649dd297b725

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RtlZeroMemory
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetCurrentProcess
WriteProcessMemory
VirtualProtect
ExitProcess

advapi32

SetServiceStatus
RegisterServiceCtrlHandlerA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
StartServiceCtrlDispatcherA

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 542B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE