5f9e1009ae818cb42de05400ca467fae_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5f9e1009ae818cb42de05400ca467fae_JaffaCakes118
Size

7KB
MD5

5f9e1009ae818cb42de05400ca467fae
SHA1

c7ef85c020a9aaf1e79bac39896cdf7a5e2041dd
SHA256

bcb95d9c55e74b084e7713a1a1b4b22ca302959f7b8c3f7736044d8943f7f777
SHA512

80816a85f7382af2d60c3f01de0fe3ccf9df58dfe68d98413397b3c7f101f725d7fcd388eb9fb1ba87f8d699dfa63040abd1b0f78b6f1e6d4736ffbee89df226
SSDEEP

96:6sQZuNjRdvi47NXdf/zw6JBM8bfR909tsLx3dESgWlfq7t:kZuNjRdviWdTMoR90ELx3qYlfq7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5f9e1009ae818cb42de05400ca467fae_JaffaCakes118

Files

5f9e1009ae818cb42de05400ca467fae_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fdf277f9fca476c6e00a81ba10469b1f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

strstr
memcpy
RtlZeroMemory

shlwapi

PathFileExistsA

kernel32

CreateFileA
CreateMutexA
DeviceIoControl
ExitProcess
CloseHandle
GetCurrentProcessId
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetSystemDirectoryA
GlobalAlloc
GlobalFree
LoadLibraryA
lstrcatA
lstrcmpiA
lstrcpyA
lstrlenA
FreeLibrary

user32

DispatchMessageA
GetMessageA
LoadCursorA
PostQuitMessage
RegisterClassExA
DestroyWindow
ShowWindow
TranslateMessage
UpdateWindow
CreateWindowExA
SetTimer
DefWindowProcA

advapi32

StartServiceA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegCloseKey
OpenServiceA
OpenSCManagerA
CreateServiceA
CloseServiceHandle

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ