1c04c630ef042d57c80bb23ae1ce88b7_JaffaCakes118

General

Target

1c04c630ef042d57c80bb23ae1ce88b7_JaffaCakes118
Size

32KB
MD5

1c04c630ef042d57c80bb23ae1ce88b7
SHA1

d89c4e5e34c4bb0ee5cabd1803624528d3136d10
SHA256

3b087d90be14749e836cacfbe3446fede04047c1dbb5ffe8b825df7969be8159
SHA512

5712dcd5818615c18a8e6b5448b533d0730e95ab86af3e5cb3ce8075436a9972db73391629d24392e28ff5f5a59312658c91a0b0c0ca391056841f19bc904876
SSDEEP

768:V1pDtKXjs9As+xMF7NqaKLTBFqBwsxpYjb6usEL:nKQV+x8yaBwWpJA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1c04c630ef042d57c80bb23ae1ce88b7_JaffaCakes118

Files

1c04c630ef042d57c80bb23ae1ce88b7_JaffaCakes118
.exe windows:5 windows x86 arch:x86

9393b3304076c423467ed39669872cb0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\exe.pdb

Imports

msvcrt

memcpy
_acmdln
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
strlen
memset
_exit
__getmainargs
_XcptFilter
_adjust_fdiv
__setusermatherr
_initterm
exit

shlwapi

PathFileExistsA

kernel32

GetStartupInfoA
GetTempPathA
CloseHandle
GetCurrentThreadId
GetModuleHandleA
LoadLibraryA
GetProcAddress
MultiByteToWideChar
SizeofResource
CreateFileA
FindResourceA
SetFilePointer
lstrlenA
SetEndOfFile
FreeLibrary
LoadResource
GlobalLock
SetFileTime
GetWindowsDirectoryA
WriteFile

user32

PostThreadMessageA
wsprintfA
GetInputState
GetMessageA

advapi32

ControlService
QueryServiceStatus
RegOpenKeyExA
RegCreateKeyExA
StartServiceA
CreateServiceA
RegQueryValueExA
RegSetValueExA
CloseServiceHandle
OpenServiceA

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 396B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 486B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9393b3304076c423467ed39669872cb0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

shlwapi

kernel32

user32

advapi32

Sections

.text Size: 3KB - Virtual size: 2KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 396B

.rsrc Size: 18KB - Virtual size: 18KB

.reloc Size: 512B - Virtual size: 486B

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 396B

.rsrc
Size: 18KB - Virtual size: 18KB

.reloc
Size: 512B - Virtual size: 486B