c8f5bdaeb7862664e4d0502ac3eeacd4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c8f5bdaeb7862664e4d0502ac3eeacd4_JaffaCakes118
Size

20KB
MD5

c8f5bdaeb7862664e4d0502ac3eeacd4
SHA1

e4936f9f8d4ac844b1af3cd2eeb8745ebc64da8c
SHA256

52fff24847e488a145523f27e3f4e45aa81ecbc52a4abf02602945a52fcc5f2a
SHA512

fd7d2e189dbf40f0b6666a89b4cdd31c3504b1b7055122771bc9515e0f7259dd32cc8830b7a608d7e9c3f44a6c7e8c4f2d1a24da599d4085eff5fddeca31f684
SSDEEP

192:4yrIuN4pIT1ifvLdLITevpyf83dXg8q6UbUxIZwx:DvN4OT1ifWTehJ3Jg8hUIxIq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c8f5bdaeb7862664e4d0502ac3eeacd4_JaffaCakes118

Files

c8f5bdaeb7862664e4d0502ac3eeacd4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

32f8bcd96a6e24a6907fcea5d3ec91d5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

remove
_snprintf

kernel32

WriteFile
CreateFileA
CloseHandle
lstrlenA
GetWindowsDirectoryA
GetModuleFileNameA
SetFileAttributesA
SetErrorMode
ExpandEnvironmentStringsA
WinExec
ExitProcess
GetFileAttributesA
GetTempPathA
lstrcatA

advapi32

RegCreateKeyA
RegSetValueExA
CreateServiceA
ChangeServiceConfig2A
StartServiceA
CloseServiceHandle
RegCloseKey
OpenSCManagerA

urlmon

URLDownloadToFileA

ws2_32

WSACleanup

Sections

.BJFnt
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.BJFnt
Size: 4KB - Virtual size: 860B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.BJFnt
Size: 4KB - Virtual size: 418B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.BJFnt
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE