d104d94adfd6d681a645f70f5c4391df_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d104d94adfd6d681a645f70f5c4391df_JaffaCakes118
Size

63KB
MD5

d104d94adfd6d681a645f70f5c4391df
SHA1

334bd8bbfb517238bc160d9ff0ab3a05909700c0
SHA256

05b534fcdcd0fb0c4341d7ee677c7408bc14b8ca4cb7917ac6bc90354e7f7fb9
SHA512

c14aec865f13e00399c816bb01e090ca288b30c0c09fa9e2917f9109d7a4e58f307299a8df0c094f6a5a86cbf74f3ffbf205662c00b7af9590bdeab87cd5e21b
SSDEEP

1536:gefmsGqFdHmjcoOGVRCfSuvKHvASRuan86YFNsTKkzqdU5:geftFsjBLVUf/y7RP8lFszj5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d104d94adfd6d681a645f70f5c4391df_JaffaCakes118

Files

d104d94adfd6d681a645f70f5c4391df_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a1e1e1b0064c2bf3f63a608a5705a5c2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegDeleteKeyW
StartServiceW
GetLengthSid
RegCreateKeyExW
LookupPrivilegeNameW
RegOpenKeyExW
OpenServiceW
AllocateAndInitializeSid
InitializeAcl
RegEnumValueW

msvcrt

_snprintf
_strnicmp
rand
_access
exit
strncpy
ftell
__p__fmode
_itoa
abs
_wctime

ole32

OleCreateLink
CoGetInterfaceAndReleaseStream
OleMetafilePictFromIconAndLabel
CoIsOle1Class
CoRegisterSurrogate
CoFreeUnusedLibraries
CoDisconnectObject
OleCreateFromFileEx
CoTaskMemRealloc
CoGetObjectContext

ulib

?QueryString@WSTRING@@QBEPAV1@KK@Z
?Stricmp@WSTRING@@QBEJPBV1@K@Z
??0WSTRING@@QAE@ABV0@@Z
??1OBJECT@@UAE@XZ
??1PRINT_STREAM@@UAE@XZ
??1FSN_FILTER@@UAE@XZ
??0SCREEN@@QAE@XZ
?SetLoggingEnabled@MESSAGE@@QAEXE@Z
?Free@MEM_BLOCK_MGR@@QAEEPAX@Z
?Initialize@PROGRAM@@QAEEKKK@Z

kernel32

IsBadStringPtrA
GetFileAttributesExW
WriteConsoleW
UnhandledExceptionFilter
CreateFileMappingW
FindVolumeClose
Module32Next
TerminateProcess
SetCommMask
GetPrivateProfileSectionA

Sections

.text
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ