5bc6b9aa1dd742abee4252dbc5a64da7_JaffaCakes118 | Triage

Sharing

General

Target

5bc6b9aa1dd742abee4252dbc5a64da7_JaffaCakes118
Size

6KB
MD5

5bc6b9aa1dd742abee4252dbc5a64da7
SHA1

33107eda95baf436155bd9402b0f8d0c50944fdd
SHA256

30c9a62763aa1ab82f6a56adce6fd1f9ead835a4118540f62261e8f0d87c77c9
SHA512

a114c717087761d17e78ffb59c9df43670ac074be082af26d119a9ecbcc96315c7fab4510105e39f0cc32da0a270c7cffa11b48e9e48903377bb4457c4dcd370
SSDEEP

96:HBWWrYpgF96QotIIgSPK3nk2j/6c4eNuo+mXxW:HgWrYCF96QEIZ35jScFo5m

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5bc6b9aa1dd742abee4252dbc5a64da7_JaffaCakes118

Files

5bc6b9aa1dd742abee4252dbc5a64da7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

adc03535b4eb4005cabb0c703135c103

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfA

kernel32

GetProcAddress
GlobalAlloc
LoadLibraryA
ReadFile
RtlZeroMemory
SetFilePointer
Sleep
GetModuleFileNameA
lstrcatA
lstrcmpA
lstrcpyA
lstrcpynA
lstrlenA
GetCommandLineA
FindClose
FindFirstFileA
GetFileSize
FreeLibrary
ExitProcess
CreateProcessA
CreateFileA
CloseHandle
WriteFile

advapi32

StartServiceCtrlDispatcherA
SetServiceStatus
RegisterServiceCtrlHandlerA
OpenServiceA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
StartServiceA

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 914B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE