28c7d28a5a876224c8ce2a6d1d5f56a7_JaffaCakes118 | Triage

Sharing

General

Target

28c7d28a5a876224c8ce2a6d1d5f56a7_JaffaCakes118
Size

24KB
MD5

28c7d28a5a876224c8ce2a6d1d5f56a7
SHA1

99f576e3e165a43dce66aef7ed78b40515fe0698
SHA256

6ce949138b04d3ae09484de3387587854550732b1386793c31b8bebb61fe90bf
SHA512

c39999c04e3ef41f3838d929dc65725451bfc4c48b28af41fb58500517f2deea9f39e5ad76289a3daa850604b664b8275199a91aa40b7a55f12271081520532f
SSDEEP

192:5cOpaEjHTgbsuBBQ6PRQkBJ6BmqBb3CLf8B:TaETTTuBBQARQkno5jaf0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28c7d28a5a876224c8ce2a6d1d5f56a7_JaffaCakes118

Files

28c7d28a5a876224c8ce2a6d1d5f56a7_JaffaCakes118
.dll windows:4 windows x86 arch:x86

eb2b0e95bfa6401c95a341637a0b6009

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
lstrcatA
lstrlenA
VirtualProtect
CloseHandle
CreateThread
GetModuleFileNameA

user32

SetWindowsHookExA
KillTimer
SetTimer
wsprintfA
UnhookWindowsHookEx
CallNextHookEx

wininet

InternetOpenUrlA
InternetOpenA
InternetCloseHandle

ws2_32

gethostname

msvcrt

_adjust_fdiv
malloc
_initterm
free
strlen
strrchr
strstr

ntdll

_strlwr
_itoa

Exports

Exports

ServiceRouteEx
StartServiceEx
StopServiceEx

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 957B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 402B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ