ac41635e8babf0de3331a7d6b692f9da_JaffaCakes118 | Triage

Sharing

General

Target

ac41635e8babf0de3331a7d6b692f9da_JaffaCakes118
Size

59KB
MD5

ac41635e8babf0de3331a7d6b692f9da
SHA1

50a72f484c6b3d5e853cbbb3eb9199fca1ebc9f7
SHA256

18122b5416ecfd204320cfe5872a44cd987b866aaa1559f318716ea9c7eebb02
SHA512

10733d09150b091635ec06b26eaff9ded7638a09dcce29ea08b77a96f341a128f6a26bdb915117a0b176fe5fa6953cc4f08f0bc01dd2019afe48e3ea875c63b8
SSDEEP

1536:Fk8mjgF5k9NnROYjBgu8xh1PjsFYxL/pDlvKstekm77T+:CKNPjsFYxL/VlSsVg+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ac41635e8babf0de3331a7d6b692f9da_JaffaCakes118

Files

ac41635e8babf0de3331a7d6b692f9da_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c26c4357c274f6639577ceeffeb1d883

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemDirectoryA
HeapAlloc
HeapFree
MoveFileExA
RtlZeroMemory
GetProcessHeap
GetTempPathA
CloseHandle
WriteFile
lstrcatA
lstrcpyA
lstrlenA
GetFileAttributesA
GetModuleFileNameA
GetFileTime
CreateFileA
ExitProcess
DeleteFileA
SetFilePointer
SetFileTime
WinExec

advapi32

StartServiceA
RegSetValueExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
OpenSCManagerA
CloseServiceHandle
OpenServiceA

user32

wsprintfA

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 850B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE