8ae933f65aa691a407cc081e3101eeeb_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8ae933f65aa691a407cc081e3101eeeb_JaffaCakes118
Size

9KB
MD5

8ae933f65aa691a407cc081e3101eeeb
SHA1

4c3333209f32f65c669f347920e4346a7be807c1
SHA256

08df109a3097d1ea0e87325e8f4e238142612c72b874603d55a01a0d34c64651
SHA512

d3ddfc759fde8ac8df3e73a2034e161466d3105fb8876936f38427cdb489a6f42318ff9fa11f5f0f709ff091e50cce088268a8022a6df6588552c5359219bcda
SSDEEP

192:8LK107JjYlxhnKYWSgfxnVESujDmZDms+tgSem:8Lq07Sl3nzWSSVPuq+tgSe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8ae933f65aa691a407cc081e3101eeeb_JaffaCakes118

Files

8ae933f65aa691a407cc081e3101eeeb_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4c065c5c66dde6482c5134a1799819df

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA

kernel32

MultiByteToWideChar
ReadFile
SetFileAttributesA
Sleep
GetWindowsDirectoryA
VirtualFree
VirtualProtect
GetModuleHandleA
lstrcatA
lstrcpyA
lstrlenA
GetModuleFileNameA
GetLastError
GetFileSize
ExitProcess
CreateFileA
CopyFileA
CloseHandle
VirtualAlloc
WriteFile

advapi32

StartServiceA
RegCloseKey
QueryServiceStatus
OpenServiceA
OpenSCManagerA
ControlService
CloseServiceHandle
ChangeServiceConfigA
RegSetValueExA
RegOpenKeyExA

winspool.drv

DeletePrintProvidorW
AddPrintProvidorW

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ