a3141afb3bf493eb8352138014883319_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a3141afb3bf493eb8352138014883319_JaffaCakes118
Size

29KB
MD5

a3141afb3bf493eb8352138014883319
SHA1

ba1043870e2e52020f0492c64df46f144bd05532
SHA256

0d1c5ae2d173c4a32672f99b455d435107f5a19ddb74febb7cca11daf73712ea
SHA512

dc9fcfdee29979f3b3bce27ec124f68c8aa275ee6901add0628489ed4cd7af258cc1ad639238971c7c28d9715ddd6a68a53f443c5e27acd900f5d5ccd3c7558c
SSDEEP

384:SCP1z8ImC1gwH7MSKiOlZiKxJ5wnxp9Z42lTeTytDqUbhD1bQljFWN:Su4011gSKrl4s+tDqU11bQDW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a3141afb3bf493eb8352138014883319_JaffaCakes118

Files

a3141afb3bf493eb8352138014883319_JaffaCakes118
.exe windows:4 windows x86 arch:x86

95e8844db0dce96e6a36fdd0c8463ed0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadResource
FindResourceA
GetProcAddress
LoadLibraryA
GetModuleHandleA
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
Process32Next
Process32First
GetModuleFileNameA
LockResource
GetLastError
DeviceIoControl
MoveFileA
GetWindowsDirectoryA
DeleteFileA
FreeLibrary
CopyFileA
lstrcatW
GetWindowsDirectoryW
GetVersionExA
GlobalFree
LoadLibraryExA
GlobalAlloc
GetSystemDirectoryA
CreateFileA
SizeofResource
WriteFile
CloseHandle
Sleep
FreeResource

advapi32

OpenSCManagerA
OpenServiceA
StartServiceA
CloseServiceHandle
RegCreateKeyA
ControlService

msvcrt

exit

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ