bad596a299676b6bb9ce7ad1411e0a47_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bad596a299676b6bb9ce7ad1411e0a47_JaffaCakes118
Size

27KB
MD5

bad596a299676b6bb9ce7ad1411e0a47
SHA1

19c538fc243a44a1ae36fdda2d79ccea6a3782e7
SHA256

ef19e7be1fd81f14cea507444bdf49d1cea2eae11c31c4415d38f55b894b9c90
SHA512

b5b69c6c8390e1c77ff9878e61a96427bfbedae5c727e2d93a75fdf117638c5c88bd96136b5785540b5432f3d74661f710b28d1e77827d7831c5d1719c0fd25c
SSDEEP

384:OF/k89izogsqL3qC03TjIZ/3uSxwuffvLEgmgKbCKhmMsP3VmvdnMH:2kZzohqL3qCea3ugvfXLybAPsFM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bad596a299676b6bb9ce7ad1411e0a47_JaffaCakes118

Files

bad596a299676b6bb9ce7ad1411e0a47_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1e1d46e3bf6a210f761f54a7abb04fc5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcessId
GetTickCount
GetLastError
lstrlenA

user32

wsprintfA

advapi32

OpenServiceA

ntdll

strncpy
memset
memcpy
strlen
strcpy
strcmp
_allmul
wcscmp
wcscpy
wcslen
strstr
RtlUnwind
NtQueryVirtualMemory

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE