968c4d7736ce416937ab7a3ff94407c2_JaffaCakes118 | Triage

Sharing

General

Target

968c4d7736ce416937ab7a3ff94407c2_JaffaCakes118
Size

820KB
MD5

968c4d7736ce416937ab7a3ff94407c2
SHA1

dc4f35f02a5ed5790767de9fb6d9c34d9a7f5a11
SHA256

fedfd6690552c4f85d0eecd3567b7a18326081d875ac6dfe9e8058776a23b985
SHA512

583e5438af611427b02356a333e302efd6a9c2279433befe4f9c17376dd81cc39d749d3732aa416ca71d6f1262e41951debbac769d716ab86867618785736dbf
SSDEEP

24576:BRM5tMnyte4DRTxfsUSSbj5kp4dTpMki:BRMnMnyteufsU5bjeL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
968c4d7736ce416937ab7a3ff94407c2_JaffaCakes118

Files

968c4d7736ce416937ab7a3ff94407c2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ea4b37ba1e8ad42103a19853a5272068

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateMutexA
GetExitCodeProcess
GetEnvironmentVariableW
GlobalFree
WriteFile
lstrlenA
ResetEvent
VirtualAlloc
GetCommandLineA
GetACP
GlobalSize
GetStdHandle
ResumeThread
InterlockedExchange
CreateEventA
LocalFree
CloseHandle
FindVolumeClose
GetPrivateProfileIntW
GetModuleHandleW

advapi32

RegCreateKeyExW
IsTextUnicode
RegCloseKey
CreateServiceA
IsValidAcl
RegQueryValueW
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyW
CloseEventLog
ControlService
IsValidSid
ClearEventLogA

admparse

ResetAdmDirtyFlag
ResetAdmDirtyFlag
ResetAdmDirtyFlag
AdmClose
ResetAdmDirtyFlag

appwiz.cpl

ConfigStartMenu

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 810KB - Virtual size: 810KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ