2dec01c269daf0c558d383b7e2b1be51_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2dec01c269daf0c558d383b7e2b1be51_JaffaCakes118
Size

22KB
MD5

2dec01c269daf0c558d383b7e2b1be51
SHA1

1eba995da8900d34ca8845ac0757b376fcf5b760
SHA256

ad70ee0f9ee56bea0bae01c1f564a27198f634015b37069b28c85588b4208094
SHA512

b1f068c26ba20bd618fbabd891fed8eb68ce081601b085b50a9e913f7aecf39cf74a1d10cd984ea92b358bf92f3f2ca6a283ae907fa8cacb80e0a751f48c546e
SSDEEP

384:lqTyJbFViqgb1fBGWzGjrY8Rqkl1vSyWqUZOdzzqzXHpK555EROzKLdCW4N:xFkZfBnGjEJk3qyYZAWHpK555kuK5cN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2dec01c269daf0c558d383b7e2b1be51_JaffaCakes118

Files

2dec01c269daf0c558d383b7e2b1be51_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ba0ccec1498c3d09fd8786fd505a903f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesExA
CreateProcessA
Sleep
GetTempFileNameA
SetFileTime
GetTickCount
GetModuleFileNameA
GetLastError
GetSystemDirectoryA
DeleteFileA
MoveFileExA
DeviceIoControl
CloseHandle
CreateFileA
GetWindowsDirectoryA
GetTempPathA

advapi32

ControlService
OpenServiceA
StartServiceA
CreateServiceA
CloseServiceHandle
OpenSCManagerA
DeleteService

msvcrt

strrchr
_strlwr
strlen
fclose
fwrite
fopen
strncpy
fread
strcat
strcpy
sprintf
memset
_stricmp
rand
srand
_snprintf

shlwapi

SHSetValueA
SHDeleteValueA

setupapi

SetupIterateCabinetA

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 992B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ