0294995084e9cbef4e9152f18550aa27_JaffaCakes118 | Triage

Sharing

General

Target

0294995084e9cbef4e9152f18550aa27_JaffaCakes118
Size

78KB
MD5

0294995084e9cbef4e9152f18550aa27
SHA1

af6b529b7cb55ffd78a7044e391fa51e559c1f89
SHA256

e65cb4e628261a599ce0f8b44eb27c829d444d3932460f0ac0fb8ad2391daa34
SHA512

a5f047be0cc26da4f53aa3d088575a020ce11ea6a115ca48e54f137e3f1caaeb62f58b23c2f1d8b6a54429be3d84887c452428cd09700241d5c66349c82e6374
SSDEEP

1536:H+KLo8HonxYqI35UDeDA30kvQ+1GVJvuqqb0atmk0+/3E4v:nLogonxYqWtEEkvQsoBqbTR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0294995084e9cbef4e9152f18550aa27_JaffaCakes118

Files

0294995084e9cbef4e9152f18550aa27_JaffaCakes118
.exe windows:5 windows x86 arch:x86

00293ea69d09f120c163288733e6398a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

EnumFontFamiliesExW
Arc

msvcrt

_ltow
_except_handler3
sscanf
??2@YAPAXI@Z
_endthreadex
_fsopen
wcscpy
exit
__p__fmode
wcschr
_write
strerror
_tzset

advapi32

OpenProcessToken
RegSetValueExA
RegOpenKeyW
RegQueryInfoKeyW
RegQueryInfoKeyA
AdjustTokenPrivileges
RegQueryValueExW
RegCreateKeyExW
QueryServiceConfig2A
EnumServicesStatusExA
RegFlushKey

kernel32

GetSystemTime
InterlockedCompareExchange
GetExitCodeProcess
LoadLibraryA
DeleteFileA
GetTempFileNameA
VirtualAlloc
GetPrivateProfileSectionA
TlsSetValue
ExitProcess

Sections

.text
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 6KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 5KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ