3d3929cc121ebc9f19ebd9eba2060d80_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3d3929cc121ebc9f19ebd9eba2060d80_JaffaCakes118
Size

820KB
MD5

3d3929cc121ebc9f19ebd9eba2060d80
SHA1

f917e094eef4a2d8464db38a3dbd2a533f81fb73
SHA256

b6e44725aae76c95196cb01fa8061663aff0cbed4f5171466b2acdd2f887d10a
SHA512

867a7a03e285ce2c3c7f44431babe3fbff831899a4b0adfffda31d68c5852c48e38fdb23ab158a49a296e42486e032b4a3c783c0f98f334f578a48aa6d51b87c
SSDEEP

24576:IMRMtjbiJIecoAKaPbQf+kmHHqdrKxoBhsTk:IMRMYJIeAPc3mnq9K6BhsT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3d3929cc121ebc9f19ebd9eba2060d80_JaffaCakes118

Files

3d3929cc121ebc9f19ebd9eba2060d80_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6a628a826c4e9d34fb4d3c71949debfc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteFile
FindVolumeClose
lstrlenA
CreateMutexA
GetModuleHandleW
VirtualAlloc
GetPrivateProfileIntW
GetCommandLineA
LocalFree
ResetEvent
GlobalSize
GetACP
GetEnvironmentVariableW
GetExitCodeProcess
ResumeThread
GlobalFree
CloseHandle
CreateEventA
GetStdHandle
InterlockedExchange

advapi32

RegCreateKeyExW
RegDeleteKeyA
RegCloseKey
RegQueryValueW
CloseEventLog
RegDeleteValueA
ClearEventLogA
RegEnumKeyW
ControlService
IsValidSid
IsTextUnicode
IsValidAcl
CreateServiceA

admparse

ResetAdmDirtyFlag
ResetAdmDirtyFlag
ResetAdmDirtyFlag
AdmClose
ResetAdmDirtyFlag

appwiz.cpl

ConfigStartMenu

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 810KB - Virtual size: 810KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ