ab101ef83895bfcf93836950a0e8eb31_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ab101ef83895bfcf93836950a0e8eb31_JaffaCakes118
Size

44KB
MD5

ab101ef83895bfcf93836950a0e8eb31
SHA1

5f2b6efb1e719c7e1b5b89e3eddfdd1e6d7ac853
SHA256

8813894a62d570e60e892ee1aad7f70493af9cf07025990eee075e465ec0e6ad
SHA512

12d385308689e50ede7a2ba0824a19ee5245519ec8d3e7fa85d24b1dcc2120aa43ac53813d723a58c082b97355bb75efcbe5d63ce48696e0e8ee9ab680b17259
SSDEEP

768:tRjiTm1dGdDhl1x81R3m6+imwY76T/I3SoaXJJKn9OkIjxq:tRjXWdDhJyR3m6+imw8JSoMzCOBdq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ab101ef83895bfcf93836950a0e8eb31_JaffaCakes118

Files

ab101ef83895bfcf93836950a0e8eb31_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e70ed53ae1f97764a9ff7ba170a16230

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

StartServiceW
OpenSCManagerW
ControlService
OpenServiceW
CloseServiceHandle

ntdll

NtQuerySystemInformation
RtlFreeHeap
ZwOpenKey
ZwEnumerateKey
NtCreateFile
NtSetInformationFile
NtClose
ZwSetValueKey
ZwCreateKey
RtlAllocateHeap
_stricmp
NtQueryInformationFile
NtWriteFile
NtReadFile
ZwQueryValueKey

kernel32

MoveFileExA
GetModuleFileNameA

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE