36af1a0a79bde082f0a29db12bd3771d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

36af1a0a79bde082f0a29db12bd3771d_JaffaCakes118
Size

286KB
MD5

36af1a0a79bde082f0a29db12bd3771d
SHA1

9e5128d76eb39b66fbefe634ca5e83a4fba2b53f
SHA256

d77486f6f1333ca4a2f0c64bcd6b0c88039016fb0f0939486b0993be8e31cd7a
SHA512

ba030b04dfe3f8a1df5d038ba7218b1ab6e6647ec46e662f1d84c7b61d923cae50331554a726b733f3a41fd4bc83f9623f8155526bbc5e6d3bb1b5aa1d70e08e
SSDEEP

6144:IGEzRM96y4+AGeJKiIdDjky49jypOAEWZqnKET5EIyLjRK+:URM9pAGliLy8hAEWZ+7TSHRK+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
36af1a0a79bde082f0a29db12bd3771d_JaffaCakes118

Files

36af1a0a79bde082f0a29db12bd3771d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

71d66090e49bca8e695c40adbd6f26c3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReleaseMutex
CreateEventW
LocalSize
GlobalFree
GetSystemInfo
lstrlenA
LoadLibraryW
InterlockedExchange
GetEnvironmentVariableA
CloseHandle
GetPrivateProfileIntA
ResetEvent
SuspendThread
VirtualAllocEx
LocalFree
CreateMutexW
GetStdHandle
WriteFile
FreeConsole
GetCommandLineW

advapi32

RegDeleteValueA
RegQueryValueW
CreateServiceW
ControlService
RegEnumKeyA
IsValidSecurityDescriptor
CloseEventLog
RegCloseKey
RegCreateKeyExW
IsValidSid
InitializeSid
ClearEventLogW
IsTextUnicode
InitializeSid

fwcfg

InitHelperDll
InitHelperDll
InitHelperDll
InitHelperDll
InitHelperDll

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 370KB - Virtual size: 370KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ