6ede63d6f216affbb57a26200fd31608_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6ede63d6f216affbb57a26200fd31608_JaffaCakes118
Size

88KB
MD5

6ede63d6f216affbb57a26200fd31608
SHA1

62e00701f62971311ef8e57f33f6a3ba8ed28bf7
SHA256

b602ce32b7647705d68aedbaaf4485f1a68253f8f8132bd5d5f77284a6c2d8bb
SHA512

afc2d1509c4e023e982752e570523558980e78a285c14f2316282c29cb302e72d1ec0d2c84b9e4ce309ecf1dd96fe35e0508607ee02c3e10e376ddc39b68ee88
SSDEEP

1536:zj1jtl3ZwdybbJFk9pFfj6LO6eFuHIASGSeCw/7WYkUz+Zt8QwcwIGGI:n1jt5ZdnHJvefdZUKZtW7GI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6ede63d6f216affbb57a26200fd31608_JaffaCakes118

Files

6ede63d6f216affbb57a26200fd31608_JaffaCakes118
.dll windows:6 windows x86 arch:x86

5715e185bb777e828f4965b97c5aa832

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DisableThreadLibraryCalls
GetCurrentThreadId
QueryPerformanceCounter
GetCurrentProcess
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
GetProcAddress
HeapFree
HeapAlloc
GetProcessHeap
VirtualAlloc
VirtualFree
LoadLibraryA
GetVersionExA
GetStartupInfoW
VirtualProtect

Exports

Exports

ServiceMain

Sections

.text
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ