39c0a83d4c8fa2784481859e773b4493_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

39c0a83d4c8fa2784481859e773b4493_JaffaCakes118
Size

18KB
MD5

39c0a83d4c8fa2784481859e773b4493
SHA1

5014131cbeb377de7f6df4bec62028ae7766fc74
SHA256

63d0a8b0cf63ec1ee9f389ea108210e03c18d298cd1e26944a6b1c88fbbd9d61
SHA512

eff9d93130ab837e6ad579ecf6deea3193527d0e83ccb4a99cd75f0269fb66937644b450fee63818c36f122b72c30ab051da573c8dbb8300edd9f686c38d12ac
SSDEEP

384:snpvQF6qrZCr1KxVCZvCIWlSfv8Y3v5WMo/bwW:snpvM9RxVCZ1WEfv8Y3v+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
39c0a83d4c8fa2784481859e773b4493_JaffaCakes118

Files

39c0a83d4c8fa2784481859e773b4493_JaffaCakes118
.dll windows:4 windows x86 arch:x86

7531cecb67d7f3fbbf2a67ef6638842f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleFileNameA
GetProcAddress
LoadLibraryA
lstrcmpiA
CloseHandle
WaitForSingleObject
FreeConsole
CreateThread
GetSystemDirectoryA
ExitProcess

user32

OpenWindowStationA
GetProcessWindowStation
SetProcessWindowStation
CloseWindowStation

msvcrt

_initterm
strrchr
strcat
memcpy
strncpy
strlen
free
malloc
_adjust_fdiv

advapi32

RegisterServiceCtrlHandlerExA
SetServiceStatus

Exports

Exports

DriverProc
ServiceMain
widMessage
wodMessage

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 262B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ