bb570cd7d43c633ef82030ffed43268e_JaffaCakes118 | Triage

Sharing

General

Target

bb570cd7d43c633ef82030ffed43268e_JaffaCakes118
Size

20KB
MD5

bb570cd7d43c633ef82030ffed43268e
SHA1

b2edabc7d6c7e54c8983824ee26a98922264be00
SHA256

061486d6abfaadbb2b26be931c134d3972e4f183978d4b860ac638d8ac4b6047
SHA512

11a8289fa8c40f8e4e31879b333410982a09d64b7e0d72de72b23df775dd2873b8d998c24302d5928f967cbaaea04affa5c82ff2192cd4e2fda186dcb6670180
SSDEEP

384:mzBBd7izujgirmO+hc/mDiDwAiqhni1OvsiyuGOplF1YX:mzBb7iajgirmO+hc/mDiDwAiqli1OvsF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bb570cd7d43c633ef82030ffed43268e_JaffaCakes118

Files

bb570cd7d43c633ef82030ffed43268e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

14d19e51aed6884b2ddbba02034b2e6e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
LoadLibraryA
GetProcAddress
CreateToolhelp32Snapshot
Process32First
GetCurrentProcessId
Process32Next
OpenProcess
CloseHandle
GetLastError
GetStartupInfoA

user32

CharLowerA

advapi32

RegSetValueExA
RegOpenKeyExA
RegCloseKey
RegCreateKeyExA
OpenSCManagerA
ControlService
StartServiceA
OpenServiceA
DeleteService
CreateServiceA
CloseServiceHandle

psapi

GetModuleFileNameExA

msvcrt

strcpy
strstr
sprintf
strlen
strncmp
strrchr
strcmp
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE