f09d832bea93cf320986b53fce4b8397_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f09d832bea93cf320986b53fce4b8397_JaffaCakes118
Size

16KB
MD5

f09d832bea93cf320986b53fce4b8397
SHA1

df0d7583a0909c61535df01dc5188547649bc6e4
SHA256

25df61b75dd678201129fe87ca5f49a85d3bdad8be7f43c16f74acf89cf93153
SHA512

0e6d08370b3c55d0a26a5765efb1549dcf421e087e170bc4208178a0f3d4bf05e24da214877fcbbea35a06d2dbc621f8bd363321d0bf0321de49aefaa77e58ae
SSDEEP

384:V9bH9SY/YFddylAfcdp9mcYHNap5OaKOsEtt9WieTWSv:XbdhAOlecbcHtw5Oa2Es

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f09d832bea93cf320986b53fce4b8397_JaffaCakes118

Files

f09d832bea93cf320986b53fce4b8397_JaffaCakes118
.exe windows:4 windows x86 arch:x86

22b6cab7e75a97f98dfe0eaaa991fc4c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MoveFileExW
CreateFileW
WriteFile
CloseHandle
GetModuleFileNameW
lstrcatW

advapi32

ChangeServiceConfig2W
RegSetValueExW
RegCreateKeyW
StartServiceW
LockServiceDatabase
UnlockServiceDatabase
CreateServiceW
OpenSCManagerW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
CloseServiceHandle
OpenServiceW

shell32

SHGetSpecialFolderPathW

msvcrt

wcschr
wcscpy
wcscat
wcslen
_wutime
_wstat

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 810B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE