3cbfa27a39285339ec0b0f95aa4c2dd8_JaffaCakes118

General

Target

3cbfa27a39285339ec0b0f95aa4c2dd8_JaffaCakes118
Size

40KB
MD5

3cbfa27a39285339ec0b0f95aa4c2dd8
SHA1

1c9b6ec4464e8b692ea7c0ed73c2ee9de6a28721
SHA256

9cdf4b9aff007e07bb3a6b829a9a98607723ca6217ae9c920a1bdf7efc6e94de
SHA512

6bf62b1ad981d424a3e84cd8c5929bcf1aa681db0dd6afae0ffc727277af7063efc149de17503c8f7d0da25a2e459622bb57fc8f97edb73b88bd2f7e6de92225
SSDEEP

768:DoXb+QT94nL4+oo8VCLFFcbz9JIZ71wDeBe592C:qB4HDcbJa1pygC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3cbfa27a39285339ec0b0f95aa4c2dd8_JaffaCakes118

Files

3cbfa27a39285339ec0b0f95aa4c2dd8_JaffaCakes118
.exe windows:6 windows x86 arch:x86

da0b2add84c00d26ef73035e812c6ad9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\lstudio\projects\insconfig\objfre_wxp_x86\i386\InsConfig.pdb

Imports

advapi32

RegCloseKey
RegSetValueExA
RegCreateKeyExA
CloseServiceHandle
StartServiceA
RegCreateKeyA
ChangeServiceConfig2A
OpenServiceA
CreateServiceA
OpenSCManagerA
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
DeleteService
ControlService
QueryServiceStatus
QueryServiceConfigA

kernel32

GetComputerNameA
CloseHandle
ReadFile
SetFilePointer
CreateFileA
GetModuleFileNameA
Sleep
DeleteFileA
CreateProcessA
GetVersionExA
GetSystemDirectoryA
GetLastError
WriteFile
LockResource
LoadResource
SizeofResource
FindResourceA
LocalFree
LocalAlloc
FreeConsole
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
RtlUnwind
InterlockedCompareExchange
InterlockedExchange

msvcrt

__getmainargs
_cexit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_controlfp
_strnicmp
memcpy
_stricmp
strncpy
strncat
sprintf
memset
_exit

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

da0b2add84c00d26ef73035e812c6ad9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

Sections

.text Size: 11KB - Virtual size: 10KB

.data Size: 1KB - Virtual size: 3KB

.rsrc Size: 25KB - Virtual size: 25KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 11KB - Virtual size: 10KB

.data
Size: 1KB - Virtual size: 3KB

.rsrc
Size: 25KB - Virtual size: 25KB

.reloc
Size: 1KB - Virtual size: 1KB