2f5530af835abf29acbc141593c9fabb_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2f5530af835abf29acbc141593c9fabb_JaffaCakes118
Size

11KB
MD5

2f5530af835abf29acbc141593c9fabb
SHA1

68fab14742563540ebac8a1f22230835438313e4
SHA256

0fb19b0a8efc2fd99f88f34efa9b2fbc26df2f0501e6bab637cbca26c6a38eb3
SHA512

dfeea47e6779b503453090b1b2e99a86e31e89ca99ba092aae5966bcf01be64c68a942a4a355650be335ee08525cf6b543ec610b8c9c413f96c592c5e1c286f4
SSDEEP

192:iJeM5GWZMhrAzesAhtTpZ6qqLpmApON1oc:2JcF+zeZpkjpmAsbo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f5530af835abf29acbc141593c9fabb_JaffaCakes118

Files

2f5530af835abf29acbc141593c9fabb_JaffaCakes118
.dll windows:4 windows x86 arch:x86

eacaf68d9d036f14ced801e85a5f69cc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ExitProcess
WriteFile
CreateFileA
GetLastError
FreeLibrary
GlobalFree
LoadLibraryExA
GetCurrentProcessId
GetProcAddress
GetModuleHandleA
lstrcatW
GetSystemDirectoryW
LoadLibraryA
DeleteFileA
GetWindowsDirectoryA
Sleep
DeviceIoControl
GetFileAttributesA
CreateToolhelp32Snapshot
Process32First
Process32Next
GlobalAlloc
CloseHandle

advapi32

StartServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
ControlService
DeleteService
CreateServiceA

msvcrt

_strcmpi

Exports

Exports

RSDK

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ