2b0e1b612d413b2ee30490a5a5d71ef0_JaffaCakes118 | Triage

Sharing

General

Target

2b0e1b612d413b2ee30490a5a5d71ef0_JaffaCakes118
Size

48KB
MD5

2b0e1b612d413b2ee30490a5a5d71ef0
SHA1

5d9f5de7b9e27f7c1e6b90ee65546e83cb34271d
SHA256

52bd5ba50d29c3aec4a66927ac2e5b6a0bd2ddf3ff84cb4218f460881ac706b3
SHA512

35e882faa49f9d884fb5fb452a4a2715cbf1dd8f55e6ba87a127d79c76092bb647d7aa4ff3760a7df849ac0471c677d8f1c84dece9f19d75e7aec9ecdc572829
SSDEEP

768:3l83wF4989k1uW8zM4wXCOvJv/vqTSh7D+UXexcaHykgfVD814vII/BR035+yOvB:1Qu99nW8I4wXhRn/hSbxcaHykg9MRAB3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2b0e1b612d413b2ee30490a5a5d71ef0_JaffaCakes118

Files

2b0e1b612d413b2ee30490a5a5d71ef0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e60e10de831fc14cd7aef39748b2fcf6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlRandom
ZwClose
RtlAdjustPrivilege
strncpy
atoi
strstr
_itoa
sprintf
_stricmp
memset
memcpy

ws2_32

WSAGetLastError
htons

kernel32

DeleteFileA
CreateFileA
SetFilePointer
FreeLibrary
HeapAlloc
HeapFree
GetTickCount
VirtualFree
GetProcessHeap
IsBadReadPtr
ExpandEnvironmentStringsA
WriteFile
Sleep
CloseHandle
GetLastError
GetProcAddress
VirtualAlloc
CopyFileA
LoadLibraryA
GetModuleFileNameA
GetModuleHandleA
VirtualProtect
SetCurrentDirectoryA

advapi32

RegCloseKey
ControlService
OpenSCManagerA
StartServiceW
RegCreateKeyA
RegQueryValueExA
RegSetValueExA
OpenServiceW
CloseServiceHandle

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE