468607b5c92576843a9b405a37d3644e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

468607b5c92576843a9b405a37d3644e_JaffaCakes118
Size

770KB
MD5

468607b5c92576843a9b405a37d3644e
SHA1

5921e5222f09db2b077876499b5be9062de50a3e
SHA256

824146be283e88952e1fda834736067cd1e95a31b9ebdc2ee271b87d6fd3ad78
SHA512

1046abfa74fc98d8730614161df8772b053acd2b74f9e68aeb0010371952620cc5522e42da3ea8bfdef0f5b0b42fa1a876e6d6fb2d9c997493a79b0e39d3c207
SSDEEP

12288:l+cyr3T4PO4h+6uzXNRo03Tp2lW7AvYkLTS3ozadS2DH3HMwcQXi:lVyrjmO4VWRrF06aTt9kH3hcQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
468607b5c92576843a9b405a37d3644e_JaffaCakes118

Files

468607b5c92576843a9b405a37d3644e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bdce5103a3312792adfe6a67377e5701

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStartupInfoA
GetCommandLineA
HeapCreate
GetModuleHandleA
GetTimeFormatA
ReleaseMutex
VirtualQuery
CreateEventA
SetEvent
lstrlenW
LocalFlags
OpenMutexA
SetConsoleCP
SuspendThread
DeleteFileA
CloseHandle
GetModuleFileNameW
CloseHandle
GetTickCount
Sleep

advapi32

RegEnumKeyA
IsValidSid
RegCreateKeyExW
RegDeleteValueA
IsValidAcl
InitializeSid
CreateServiceW
ControlService
IsValidSecurityDescriptor
ClearEventLogW
RegQueryValueW
IsTextUnicode
CreateProcessAsUserA

msvcirt

??0Iostream_init@@QAE@XZ
??0Iostream_init@@QAE@XZ
??0Iostream_init@@QAE@XZ
??0Iostream_init@@QAE@XZ

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 763KB - Virtual size: 763KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ