3bcbb8ca0ed9fce47c962442c953d7c9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3bcbb8ca0ed9fce47c962442c953d7c9_JaffaCakes118
Size

588KB
MD5

3bcbb8ca0ed9fce47c962442c953d7c9
SHA1

f22b587217593a3c81366e2e470a848a31c523a2
SHA256

5e68291bf60f7f918e0ddd99cbf8829ff27d4a4b886e54834db7a03ebe06bfed
SHA512

3b77bb25e7b4ec245420bcb794c8377f082ef431e617e6357fbc0e9f646340576c04e478758cc0924ef96f74ddaf80e8f583dcfc9202d7bdd4b3f698c6a4dfd8
SSDEEP

768:kP6pf4oaVTeb7zg69Cm8vymHUOmLnRF8/i98lpZ:kSpUuzTzsym+Lv8q98lp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3bcbb8ca0ed9fce47c962442c953d7c9_JaffaCakes118

Files

3bcbb8ca0ed9fce47c962442c953d7c9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4affabb2583fdec36562bca0b1478ccf

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetCommandLineA
GetLastError
FreeLibrary
lstrlenA
LoadLibraryA
GetProcAddress
ExitProcess
GetStartupInfoA

user32

wsprintfA
CreateWindowExA

advapi32

StartServiceA
GetAclInformation
EqualSid
RegCreateKeyExA
RegQueryValueExA
RegDeleteKeyA
RegDeleteValueA

msvcrt

_strnset
strtok
??2@YAPAXI@Z
strchr
_except_handler3
__CxxFrameHandler
??3@YAXPAX@Z
realloc
malloc
strstr
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_strrev
_strcmpi

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 564KB - Virtual size: 561KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ