2d51be30e9a93bdff7b1d3cf230ad11c_JaffaCakes118 | Triage

Sharing

General

Target

2d51be30e9a93bdff7b1d3cf230ad11c_JaffaCakes118
Size

63KB
MD5

2d51be30e9a93bdff7b1d3cf230ad11c
SHA1

ce1bd80b90ec6ee4a87ba4b6ea3032fed8d2eaff
SHA256

fae2d0acc9ff3302f1b363a819579ecac9f1fb4872f596863f7bbe7a4edadf52
SHA512

8c1fd74004e9633183b0073eb5a0a9c38425975099ca274c216609e0ce3aa79192ed60916afdd9ec0459ef9a89e7cb3a31499e39201ae36a66a26293bdb6d69f
SSDEEP

1536:gefmsGqFdHmjcoOGVRCfSuvKHvASRuan86YFNsTKkzqdUv:geftFsjBLVUf/y7RP8lFszjv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2d51be30e9a93bdff7b1d3cf230ad11c_JaffaCakes118

Files

2d51be30e9a93bdff7b1d3cf230ad11c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a1e1e1b0064c2bf3f63a608a5705a5c2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegDeleteKeyW
StartServiceW
GetLengthSid
RegCreateKeyExW
LookupPrivilegeNameW
RegOpenKeyExW
OpenServiceW
AllocateAndInitializeSid
InitializeAcl
RegEnumValueW

msvcrt

_snprintf
_strnicmp
rand
_access
exit
strncpy
ftell
__p__fmode
_itoa
abs
_wctime

ole32

OleCreateLink
CoGetInterfaceAndReleaseStream
OleMetafilePictFromIconAndLabel
CoIsOle1Class
CoRegisterSurrogate
CoFreeUnusedLibraries
CoDisconnectObject
OleCreateFromFileEx
CoTaskMemRealloc
CoGetObjectContext

ulib

?QueryString@WSTRING@@QBEPAV1@KK@Z
?Stricmp@WSTRING@@QBEJPBV1@K@Z
??0WSTRING@@QAE@ABV0@@Z
??1OBJECT@@UAE@XZ
??1PRINT_STREAM@@UAE@XZ
??1FSN_FILTER@@UAE@XZ
??0SCREEN@@QAE@XZ
?SetLoggingEnabled@MESSAGE@@QAEXE@Z
?Free@MEM_BLOCK_MGR@@QAEEPAX@Z
?Initialize@PROGRAM@@QAEEKKK@Z

kernel32

IsBadStringPtrA
GetFileAttributesExW
WriteConsoleW
UnhandledExceptionFilter
CreateFileMappingW
FindVolumeClose
Module32Next
TerminateProcess
SetCommMask
GetPrivateProfileSectionA

Sections

.text
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ