3cceec65682b319620aaa27d73d0f939_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3cceec65682b319620aaa27d73d0f939_JaffaCakes118
Size

816KB
MD5

3cceec65682b319620aaa27d73d0f939
SHA1

dd17ef04515febcab7bea4382a582e72f9de8613
SHA256

5fe7310bdf3c2374cda26eede844331e14994c88bbf7ad95c3e46ed963ebea6b
SHA512

f3e7ef3af492ce732a4cfd7e43745b294fef179b09fa5d5b57d83213b27690dfafb65ee047e6564b83181a96096d91e38d3fa1ec500a683aab8be3019773f05e
SSDEEP

12288:mBo3+NQO5YVZWhh1+G/chNjIenedtLsduAYNm5Y26ILUPgJ1kXO2Hc7eMZD9Gxa:mBhQO5lhhPcHEenedZAubNVA/2+tMxa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3cceec65682b319620aaa27d73d0f939_JaffaCakes118

Files

3cceec65682b319620aaa27d73d0f939_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bb2b993fa64e8569996ed2bdb86c73e5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Beep
TlsGetValue
GetModuleFileNameW
GetFullPathNameW
Beep
VirtualQuery
SetCurrentDirectoryW
GetModuleHandleA
SetLocaleInfoA
TlsSetValue
Beep
SetThreadPriority
Beep
GetPrivateProfileIntA
ReleaseMutex
FormatMessageA
DeleteFileW
lstrlenW
Beep
Beep
Beep
Beep
GetCurrentThreadId
GetCommandLineA
lstrcatA
VirtualProtect
WriteConsoleW
Beep
Beep

catsrvut

StartMTSTOCOM
CGMIsAdministrator
RegDBBackup
RegDBRestore

Sections

.text
Size: 15KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 7KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_WRITE

.vdata
Size: 797KB - Virtual size: 3.6MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ