3b9a979f754273718a68ba124903f1cf_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3b9a979f754273718a68ba124903f1cf_JaffaCakes118
Size

5KB
MD5

3b9a979f754273718a68ba124903f1cf
SHA1

89b6d125b52b2a1730a300165aebfecfea39a508
SHA256

74ef4030457dfc42ad9c506540e5bf49db94967697eb82467c77a0dc086d566e
SHA512

49cd45a2a8593a6614e20e4b3b9ba4d88fa421f70f50c0363e9ed1ad0d1f540757a1d80722ee49d8011c254f2841b2afdcf115c11520f40512ba048bfbe11ad8
SSDEEP

96:5irTyYpgHoUJdsEUkNjZX9qxhjLCN6cKsM:5OyqSXd82tX9qxhjLCNjM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b9a979f754273718a68ba124903f1cf_JaffaCakes118

Files

3b9a979f754273718a68ba124903f1cf_JaffaCakes118
.exe windows:4 windows x86 arch:x86

079a32ef7f3dd393d8dc448da2439f68

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
lstrcmpiA
GetSystemDirectoryA
ExitThread
CopyFileA
lstrcpyA
CreateThread
TerminateThread
GetCommandLineA
GetModuleFileNameA
lstrcatA
lstrlenA
GetLastError
Sleep
ExitProcess

user32

MessageBoxA

advapi32

RegCloseKey
RegCreateKeyA
RegOpenKeyA
RegQueryValueExA
OpenServiceA
ControlService
DeleteService
OpenSCManagerA
CreateServiceA
CloseServiceHandle
RegCreateKeyExA
RegSetValueExA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
RegOpenKeyExA
RegDeleteKeyA

klengine

Hide
Quit
reboot
GetCfg
Init

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 680B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE