fa06d97560dadac17ed422881074ddd6_JaffaCakes118 | Triage

Sharing

General

Target

fa06d97560dadac17ed422881074ddd6_JaffaCakes118
Size

46KB
MD5

fa06d97560dadac17ed422881074ddd6
SHA1

b2182e3cacb9807bd7e8c81d725436a15d38c81e
SHA256

38c8c38690511a32683a53428d69fff0b9e1a2f087e13f2f7460128b2ae789b9
SHA512

4deecfac960c3534e7c5810d3c0021fe00338c6d0900be4b31e4160c56a661682695a6dc0f48f804343182342978d5afbfaca89032681e87b4a45996cdb4fcef
SSDEEP

768:SkRF2oYhwWKU28G945pFPYj36pvcyeZEIUA:S7U8A45ptGKpfx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa06d97560dadac17ed422881074ddd6_JaffaCakes118

Files

fa06d97560dadac17ed422881074ddd6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3299009894fc8fb0acf034d82f5c2410

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetWindowsDirectoryA
DeleteFileA
VirtualFree
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
ReadFile
VirtualAlloc
GetFileSize
HeapAlloc
GetProcessHeap
lstrcatA
MoveFileExA
CreateFileA
WriteFile
CloseHandle
SetFilePointer
FindFirstFileA

advapi32

EnumServicesStatusA
OpenServiceA
QueryServiceConfigA
CloseServiceHandle
StartServiceA
OpenSCManagerA

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 730B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE