a44291ca629c3df1131aca7351168df4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a44291ca629c3df1131aca7351168df4_JaffaCakes118
Size

25KB
MD5

a44291ca629c3df1131aca7351168df4
SHA1

63a9f453429bd4a88c2a5a689046f16402093238
SHA256

18a77781e459883034d834721aedf1cc08c89c0021887cee7b15f340f2b10d62
SHA512

38a4d76afa136f311f38ce9650b8782e9e51b5fee652a276a2fe4e34d78838e17c66268f1a0f60708a6228ab63503f473679f30173ae68fe7a666184d80befe0
SSDEEP

384:5JO/HbbEjCgIB7WjJ5LrmfOkRtncwUCoWeW7WpeHODpWLoWqmkC0GJsJxXSoVcGg:5U72acX5ktnDUze3kmkLGKZSh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a44291ca629c3df1131aca7351168df4_JaffaCakes118

Files

a44291ca629c3df1131aca7351168df4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ec80d0ac7c51d7b67e822d80a08e5347

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
TerminateProcess
OpenProcess
WriteFile
GetSystemDirectoryA
WinExec
GetTempFileNameA
GetTempPathA
Sleep
GetFileAttributesA
SizeofResource
GetModuleHandleA
LoadResource
FindResourceA
DeleteFileA
GetModuleFileNameW
GetPrivateProfileStringA
WaitForSingleObject
ResetEvent
CreateEventA
OpenEventA
CreateThread
GetModuleFileNameA
GetWindowsDirectoryA
OutputDebugStringA
IsBadReadPtr
GetCurrentProcess
GetLastError
LoadLibraryA
GetProcAddress
lstrcmpiA
LockResource
CloseHandle

advapi32

StartServiceA
CreateServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
LookupPrivilegeValueA
QueryServiceStatus

msvcrt

_stricmp

shlwapi

SHDeleteKeyA
StrStrW
PathAppendA
StrStrIA

Sections

.data
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ