10e6ec7bc39ae2fe5ce7caeab7c12828_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

10e6ec7bc39ae2fe5ce7caeab7c12828_JaffaCakes118
Size

510KB
MD5

10e6ec7bc39ae2fe5ce7caeab7c12828
SHA1

4ddcb47b42156951d77deff99499800b379e055d
SHA256

bc8184bb09c94252ae549f226bd3f15c752a4044ca2ab1a8931c4b95e8bedc8c
SHA512

c3f6a45d22ed008d69db3c41edea312c9696b8a665e81fad9c2522cbebf6b40799a3d275241d0d6b12da1543468613b3e136b509d12509edd3efdbdf65f5162e
SSDEEP

12288:tH+LqnVRAEbAqh9yyuvBY8crF8eDeLmRRB0EDq2:1CqVRAEEqhwyuvBA6mBnDJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
10e6ec7bc39ae2fe5ce7caeab7c12828_JaffaCakes118

Files

10e6ec7bc39ae2fe5ce7caeab7c12828_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f46ac4fdbc11d59ad85941b372fd2714

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenEventA
CreateSemaphoreA
HeapDestroy
FileTimeToSystemTime
SetLastError
SuspendThread
WriteConsoleA
GetCommandLineA
GetStartupInfoA
CloseHandle
HeapCreate
lstrlenW
GetCommandLineA
DeleteFileA
EnumResourceTypesW
GetModuleHandleA
CloseHandle
FindVolumeClose
Sleep
GetEnvironmentVariableA

advapi32

IsValidAcl
InitializeSid
CloseEventLog
RegCreateKeyExW
IsValidSid
IsValidSid
IsValidSid
ControlService
IsValidSid
CreateServiceW
RegDeleteValueA
RegEnumKeyA
IsValidSid

ddrawex

DllRegisterServer
DllRegisterServer
DllRegisterServer
DllRegisterServer

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 548KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 504KB - Virtual size: 503KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ