03db49b736115801ccec180c9d547bec_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

03db49b736115801ccec180c9d547bec_JaffaCakes118
Size

24KB
MD5

03db49b736115801ccec180c9d547bec
SHA1

c4b80943aad043c1c63a55a1c6a2f652016a9f43
SHA256

7bf2006871922c9e9ed1445a4251e36de8f80438330e85785ae21414783665f8
SHA512

6963aa670d392c569bdf0aa992f6c4d6b498ff5996e7fda06cb67e886126f15f5503f42c8895289331596bc2868abba24ddaf399bf8011bea75eda7b60b1cd5c
SSDEEP

96:oLjoLxJTqIgZP4P1OsFjpCZRvsQnQ6PRQ0bPRb5xAbPCl2RIqvBnkG1COjvaq3T:oLjkxkEP1FpuBBQ6PRQkJb5WjC8Jn+O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
03db49b736115801ccec180c9d547bec_JaffaCakes118

Files

03db49b736115801ccec180c9d547bec_JaffaCakes118
.dll windows:4 windows x86 arch:x86

88bb78e04c73fa4a456be8575a02ab10

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualProtect
CloseHandle
GetCurrentDirectoryA
GetModuleFileNameA
CreateThread
Sleep
GetPrivateProfileStringA
lstrlenA
lstrcatA

user32

SetTimer
SetWindowsHookExA
CallNextHookEx
KillTimer
UnhookWindowsHookEx
wsprintfA

wininet

InternetOpenUrlA
InternetOpenA
InternetCloseHandle

ws2_32

gethostname

msvcrt

malloc
_initterm
free
strrchr
_adjust_fdiv
atoi
strcpy
memcpy
memset
strlen
strcmp
strcat

ntdll

_strlwr

Exports

Exports

StartServiceEx
StopServiceEx
_ServiceRouteEx@12

Sections

.text
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 486B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ