1609e1f3c5ee9502aaf4088b95554970_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1609e1f3c5ee9502aaf4088b95554970_JaffaCakes118
Size

148KB
MD5

1609e1f3c5ee9502aaf4088b95554970
SHA1

de4c387471a09eb4a9c02fdcd1b704c13dd04e29
SHA256

011533d0a8b4ae80729a88b2ef527c1f9ad5be796f92520809a82bca6dc938ad
SHA512

fc263d543d07349b37d4d126fa04b020bc79f4dbff4eef7f5cc6517ef132fb5b529ae614c86c4ad20d965617966820fa06429a8f0effc48aeeb70f8b7296072f
SSDEEP

3072:HolPt8gl1j5UdWDCcBuRi8NGsBlSfMzpT3ZpJ520pD0Puvc4N:H6lHI0Yie3SS3TJdpDR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1609e1f3c5ee9502aaf4088b95554970_JaffaCakes118

Files

1609e1f3c5ee9502aaf4088b95554970_JaffaCakes118
.exe windows:4 windows x86 arch:x86

543c3ce654d512c8e8ef531efc2a2352

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessA
WinExec
FindFirstFileA
GlobalFree
DeviceIoControl
GlobalAlloc
Sleep
DeleteFileA
GetTempFileNameA
GetModuleFileNameA
GetProcAddress
GetModuleHandleA
GetLastError
GetTickCount
CloseHandle
GetVersionExA
GetSystemDirectoryA
GetFileAttributesExA
CreateFileA
SetFileTime
GetTempPathA

advapi32

OpenSCManagerA
OpenServiceA
StartServiceA
CreateServiceA
CloseServiceHandle
DeleteService

msvcrt

srand
??3@YAXPAX@Z
_stricmp
strncpy
strchr
fclose
fwrite
fopen
_strlwr
strncat
_snprintf
__CxxFrameHandler
sprintf
strrchr
rand
memmove

shlwapi

SHSetValueA
SHGetValueA

rpcrt4

UuidCreate
UuidToStringA
RpcStringFreeA

setupapi

SetupIterateCabinetA

Sections

.text
Size: 147KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.CRT
Size: 16B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 992B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ