3a689ce82e798c91edec9c20ac9c44c0_JaffaCakes118 | Triage

Sharing

General

Target

3a689ce82e798c91edec9c20ac9c44c0_JaffaCakes118
Size

16KB
MD5

3a689ce82e798c91edec9c20ac9c44c0
SHA1

d0d4cbf0c7dff13fe148d9571953af1609c8fdda
SHA256

af1f71aa1cc9c1a8590aba4cdf59d13c82d71a6223df9da5ab7b55b333b55adb
SHA512

99f8b73f78d13cf60d954a8d58869eba4284c82e5d9943d79a12ebfd95f121db1a5f3988d15500b9a55028e200c04d5edec714a0521442cd4e2e7c49e785f07a
SSDEEP

384:DqnDhk5dylS4z9I0NHuslOaK2vEjmSWieTW/v:enDhk6l15IyHuslOa5Ei

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3a689ce82e798c91edec9c20ac9c44c0_JaffaCakes118

Files

3a689ce82e798c91edec9c20ac9c44c0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bbd2229304f9361a1553e03e1df3a6a3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MoveFileExW
lstrcatW
CreateFileW
WriteFile
CloseHandle
GetWindowsDirectoryW
GetModuleFileNameW

advapi32

CreateServiceW
RegSetValueExW
RegCreateKeyW
StartServiceW
LockServiceDatabase
ChangeServiceConfig2W
UnlockServiceDatabase
OpenServiceW
OpenSCManagerW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
CloseServiceHandle

msvcrt

wcslen
wcschr
_wutime
_wstat
wcscpy
wcscat

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE