6a38fe22e6969b5a0b1995f42a530714_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6a38fe22e6969b5a0b1995f42a530714_JaffaCakes118
Size

20.0MB
MD5

6a38fe22e6969b5a0b1995f42a530714
SHA1

74b4cf74bd48503ea0bd79d25e8380266d08f900
SHA256

8e634718f9e940c9bd02802dc76f9167e3953669692ce2ef4302da8ccc3ea298
SHA512

9335302ae565b3bcd69d3d5be0b095372566f6b637edf66702e882b56a52890a1d7f1100897838655d7b3679d869c00e8a2a511290359ce4ec7e6a5423b4efc8
SSDEEP

192:ecgCXBe7YE/4xyp3LYJj5sWmbdn4YeAQiIO:ecChdQ5sWKn4Yy3O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6a38fe22e6969b5a0b1995f42a530714_JaffaCakes118

Files

6a38fe22e6969b5a0b1995f42a530714_JaffaCakes118
.dll windows:4 windows x86 arch:x86

1cc681cd43fd7a11770e28dbd59fffa6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_except_handler3
_adjust_fdiv
malloc
_initterm
free
??1type_info@@UAE@XZ
??3@YAXPAX@Z
__CxxFrameHandler
??2@YAPAXI@Z
_strcmpi

kernel32

GetWindowsDirectoryA
MoveFileA
GetLastError
TerminateProcess
OpenProcess
DeleteFileA
SetLastError
lstrcpyA
LoadLibraryA
GetProcAddress
CreateToolhelp32Snapshot
lstrcmpiA
GetCurrentProcess
CloseHandle
lstrcatA
lstrlenA
GetPrivateProfileStringA

user32

wsprintfA

advapi32

OpenServiceA
StartServiceA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
RegSaveKeyA
RegRestoreKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 682B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ