396999a1122c7000dd0dcfb512384c25_JaffaCakes118 | Triage

Sharing

General

Target

396999a1122c7000dd0dcfb512384c25_JaffaCakes118
Size

14KB
MD5

396999a1122c7000dd0dcfb512384c25
SHA1

f2c6a3a081d5c6f126906f6d61e8129028f0c592
SHA256

6db1e2e2432e34e588e39f04fe20d151ce5c0dbf1baca256aa34acf390484999
SHA512

a4be3417889c92bf41ec60c57ba4e708258beb201dcc41015e0f7eea00f6d23bdf8cedbbe278a12ec07d193a3205857ac93c0e9aeb60be994ed27b8514bc0f41
SSDEEP

192:/yJ9c4WBWiQMoGcbayl9dVvuBBQ6PRQkzVYMl4Ka:e9oBzQZLHuBBQARQkZYMLa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
396999a1122c7000dd0dcfb512384c25_JaffaCakes118

Files

396999a1122c7000dd0dcfb512384c25_JaffaCakes118
.dll windows:4 windows x86 arch:x86

765a2379c789606e0c420aa0bc95ee60

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

strlen
memcpy
memcmp
RtlZeroMemory

ws2_32

closesocket
gethostname

kernel32

LoadLibraryA
EnterCriticalSection
DeleteCriticalSection
CreateThread
lstrlenA
lstrcpyA
lstrcmpiA
lstrcmpA
WaitForSingleObject
TerminateThread
Sleep
LeaveCriticalSection
CloseHandle
CreateFileA
GetExitCodeThread
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GlobalAlloc
GlobalFree
lstrcatA
ReadFile
VirtualProtectEx
InitializeCriticalSection

user32

CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
wsprintfA

Exports

Exports

ServiceRouteExA
StartServiceEx
StopServiceEx
UnHookAPI

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 392B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ