315373d0a46ce971f73f006e3d3b9729_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

315373d0a46ce971f73f006e3d3b9729_JaffaCakes118
Size

78KB
MD5

315373d0a46ce971f73f006e3d3b9729
SHA1

fefa433ce65b5f0a1e10ae03d04cfc10db30d7ab
SHA256

f5d38f4409e46413a35f8dbbef595a19c297a4db26fb562c9c22667b7aa0e3ad
SHA512

b98b2819b79541a828c00b9ee107d5c3deaa8e321016fc9df3cf6582bb74af4d37f3b9dc05fa8e3e3295a381847ee27302fdd9e1d2f2e6525acdc6ea470da9c9
SSDEEP

1536:d9/hfEyNjws6693Jhb3cK6+Ue1c/jvLZqDmk+pSG0n3Mqu://hfnNO6fhDs+UyMv7k+pnW6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
315373d0a46ce971f73f006e3d3b9729_JaffaCakes118

Files

315373d0a46ce971f73f006e3d3b9729_JaffaCakes118
.exe windows:5 windows x86 arch:x86

c12d1e1d7342858734e99111979869b1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

StartServiceW
OpenSCManagerW
ControlService
OpenServiceW
CloseServiceHandle

ntdll

RtlAllocateHeap
NtClose
NtReadFile
NtWriteFile
ZwEnumerateKey
NtQuerySystemInformation
RtlFreeHeap
ZwOpenKey
NtSetInformationFile
NtCreateFile
ZwQueryValueKey
_stricmp
NtQueryInformationFile
_chkstk

kernel32

GetModuleFileNameA
GetTempPathW
MoveFileExA
ExitProcess

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ