70e1187761460b9a1945902c6f096ba4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

70e1187761460b9a1945902c6f096ba4_JaffaCakes118
Size

20KB
MD5

70e1187761460b9a1945902c6f096ba4
SHA1

158ebc66824591d65fac6471d55fdc697aa0ee38
SHA256

a2966679743184a8888769494b1e2115a278d55ade230bebd1e1de16f014d8f6
SHA512

7445cba15ed7bbe49220de565838383529858571b5f14dc112fb703c0f0c4210f490df850af2e45e2880d92d3a5315525f6571531386e61562e97156fe6649bf
SSDEEP

192:wVL8yPvSOqFgOb0SLNolRb5NUoynTWL04ZqW:wVL8QvSOqFnrLMb5aVWL5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
70e1187761460b9a1945902c6f096ba4_JaffaCakes118

Files

70e1187761460b9a1945902c6f096ba4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

90155ed924794a63cffcad2a5d49d7b2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CloseServiceHandle
RegDeleteKeyA
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
RegQueryValueExA
RegCreateKeyExA
DeleteService
RegCloseKey
OpenServiceA
OpenSCManagerA
QueryServiceStatus
ControlService

user32

MessageBoxA

msvcrt

__setusermatherr
_adjust_fdiv
_initterm
__set_app_type
_acmdln
printf
_except_handler3
_controlfp
fgets
exit
fopen
strchr
fclose
atoi
__p__commode
sprintf
__p__fmode
_exit
_XcptFilter
__getmainargs
_stricmp

kernel32

GetStartupInfoA
GetVersionExA
Sleep
LoadLibraryA
GetTickCount
FreeLibrary
OpenProcess
GetProcAddress
CreateProcessA
GetLastError
GetModuleHandleA
TerminateProcess
CloseHandle

Sections

.text
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE