3514abc3856225b3ca2a579cc670a7a8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3514abc3856225b3ca2a579cc670a7a8_JaffaCakes118
Size

78KB
MD5

3514abc3856225b3ca2a579cc670a7a8
SHA1

ec8d74bd669b5942e63d9165b6b9bb6029e03fdd
SHA256

25671db74475f9eb65c159c72d72bd310af10a1277bfc29ef941e573907278a0
SHA512

23e3c5990203065cefb6d84a6e8673866cbcdba0e80ec77f6005aa43f5bbf67105e843fdf05986e87977c1fad697319ca8b4f619752bed6b319d614419cdff85
SSDEEP

1536:rzSs1rwGf/tmm1QUyiG3uTeOz49BPo8gyrBvsXroH88:rDrwqom1QUyZdBPjB0XroH88

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3514abc3856225b3ca2a579cc670a7a8_JaffaCakes118

Files

3514abc3856225b3ca2a579cc670a7a8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

05bf4d7b88ef63084696a709d8044ff6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WritePrivateProfileStringA
GetPrivateProfileStringA
GetModuleFileNameA
GetTickCount
Sleep
lstrcatA
GetLastError
FindResourceA
LoadResource
GetSystemDirectoryA
CreateFileA
SizeofResource
lstrcpyA
WriteFile
CloseHandle
FreeResource
SetLastError
lstrlenA
GetCurrentThreadId

user32

GetMessageA
PostThreadMessageA
GetInputState
wsprintfA

advapi32

RegDeleteValueA
OpenServiceA
CloseServiceHandle
StartServiceA
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
CreateServiceA
DeleteService
ControlService
QueryServiceStatus
OpenSCManagerA

shlwapi

SHDeleteKeyA

msvcrt

strcpy
??1type_info@@UAE@XZ
??3@YAXPAX@Z
srand
rand
fopen
strlen
_except_handler3
??2@YAPAXI@Z
memcpy
_stricmp
memset
__CxxFrameHandler
_CxxThrowException

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ