306393cf6246d8e7904e49803a16114d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

306393cf6246d8e7904e49803a16114d_JaffaCakes118
Size

14KB
MD5

306393cf6246d8e7904e49803a16114d
SHA1

4be966651ef9e8a62d7062a81d346ec274a2ba9f
SHA256

0d3d0ce5300e81deb7563aa49a9e9bb296fad2b0162059dba23e6864eff36c50
SHA512

10f8b9a0a610921b504f91ba5d7bbcced69329ced724c2766376cf3e8f4e306f88370b437beb7cdd12c6b460f5799058cc5180964e710db44027a303939609a5
SSDEEP

96:SyRkP0EMoIlXxaY+4sLDmBVNZ5xmFDxCkFWBqb60tjpm:SyRU0EMomXxhseHD5JkFWBnk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
306393cf6246d8e7904e49803a16114d_JaffaCakes118

Files

306393cf6246d8e7904e49803a16114d_JaffaCakes118
.exe windows:5 windows x86 arch:x86

6e771352086856abbfb3b2b06ef8a7cf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
SetServiceStatus

kernel32

ExitProcess
CloseHandle
ResumeThread
SetThreadContext
WriteProcessMemory
VirtualAllocEx
GetThreadContext
CreateProcessA
ReadFile
SetFilePointer
VirtualAlloc
CreateFileA
GetModuleFileNameA

Sections

.text
Size: 1024B - Virtual size: 841B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 552B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE