5a7d3db15c3eb9c6dcfb9301b0d4492f_JaffaCakes118 | Triage

Sharing

General

Target

5a7d3db15c3eb9c6dcfb9301b0d4492f_JaffaCakes118
Size

56KB
MD5

5a7d3db15c3eb9c6dcfb9301b0d4492f
SHA1

6c213a5f85c07a799fe24b8d0736276b836a73de
SHA256

d66580528633df9993b5fd6c18e0a82dcc1f57d6016f2df034eb9ad18ae0e938
SHA512

b85b06079c87a2fcad31111ccba486bb152946db3427662a60dacbccdf2803548925c3d249da38b3adf992bc206a3a4ce2669400e82c46e96e8879195a261cc2
SSDEEP

768:az2cmHK3xbdGow1NnYZklxeHA38w/vw42/pzodD2GeZQn/ECqyYZAgOGeSIW555w:aqcmHn1B+klxBQ/pM1eZ0/TIZc1rocN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5a7d3db15c3eb9c6dcfb9301b0d4492f_JaffaCakes118

Files

5a7d3db15c3eb9c6dcfb9301b0d4492f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

617aba6aea4a89048933805ef3859feb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesExA
CreateProcessA
Sleep
WinExec
GetTempFileNameA
SetFileTime
GetTickCount
GetModuleFileNameA
GetLastError
GetSystemDirectoryA
DeleteFileA
MoveFileExA
DeviceIoControl
CloseHandle
CreateFileA
GetWindowsDirectoryA
GetTempPathA

advapi32

ControlService
OpenServiceA
StartServiceA
CreateServiceA
CloseServiceHandle
OpenSCManagerA
DeleteService

msvcrt

strrchr
_strlwr
strlen
fclose
fwrite
fopen
strncpy
fread
strcat
strcpy
sprintf
memset
_stricmp
rand
srand
_snprintf

shlwapi

SHSetValueA
SHDeleteValueA

setupapi

SetupIterateCabinetA

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 992B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ