ef9b79d6df01c7f7494d79ec1bbe273f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ef9b79d6df01c7f7494d79ec1bbe273f_JaffaCakes118
Size

60KB
MD5

ef9b79d6df01c7f7494d79ec1bbe273f
SHA1

7268ac1de5ffb64ea58b1c09c7847619b3c375a9
SHA256

e05bd0b84984899cee265a9165c0267e1456c82e2bc3ab0728b161a9163b22c9
SHA512

6342470657ee26ca860e6540e42120a3209ac9d639bf80dfcb8117688ab13fb65f4144d136b01683fcb8eb3e117c144c068fea3c5e9829379c2a9dbf96422366
SSDEEP

1536:ab1vILdR69Zlsy/cQU5SHnaPqsHIt1Nk6bxe:k1KC9HRcZWaPqIITNkEw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ef9b79d6df01c7f7494d79ec1bbe273f_JaffaCakes118

Files

ef9b79d6df01c7f7494d79ec1bbe273f_JaffaCakes118
.exe windows:5 windows x86 arch:x86

4c8c47d3c68c9f9ab708007aa7cfbecd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\PRIVATE\mydll\OUTPUT\Install.pdb

Imports

msvcrt

memcpy
srand
rand
??3@YAXPAX@Z

kernel32

GetFileAttributesExA
GetTickCount
SetFileTime
WriteFile
WideCharToMultiByte
GetCurrentProcess
GetFileAttributesA
TerminateProcess
ReadFile
GetSystemDirectoryA
GetLastError
SetFilePointer
GetModuleHandleA
WinExec
CloseHandle
CreateFileA
Sleep
GetModuleFileNameA

user32

wsprintfA

advapi32

OpenServiceA
OpenSCManagerA
StartServiceA
DeleteService
CreateServiceA
CloseServiceHandle

shlwapi

SHSetValueA

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ