4443468b1eceff007f9f394a7360e1f4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4443468b1eceff007f9f394a7360e1f4_JaffaCakes118
Size

17KB
MD5

4443468b1eceff007f9f394a7360e1f4
SHA1

d4f79dfa854e334fee07fd4aa5effecd439de262
SHA256

576f68c22fadcc3ba6da35bf885ffb27a260ac2ff0856df70a6ae43ae1135e1e
SHA512

fe5aab15d656f70ce158e7f9daddbe2dec38baeaa710f61093bc09fe527fab4e539bc94c9c9b38a3281c2a6465d093cf34a4be6352408ffa1d64da9c393dbfa2
SSDEEP

384:lw1U36eZrhKtmvPL89nafCWwL88UWh/NJR5uxy/Hqs91vZItwx:Ke3jZrstmvPcy78xJRL1vZIC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4443468b1eceff007f9f394a7360e1f4_JaffaCakes118

Files

4443468b1eceff007f9f394a7360e1f4_JaffaCakes118
.dll windows:4 windows x86 arch:x86

125fcd522f817374dfcd3a22be80b62e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ExpandEnvironmentStringsA
GetModuleFileNameA
GetLastError
CreateMutexA
GetCurrentProcessId
VirtualAlloc
VirtualProtect
LoadLibraryA
GetTempPathA
GetTickCount
LoadLibraryExA
GetProcAddress
DeleteFileA
FreeLibrary
CreateFileA
WriteFile
GetFileSize
ReadFile
CloseHandle

msvcrt

_adjust_fdiv
_initterm
free
memmove
sprintf
fopen
fseek
ftell
fread
fclose
_except_handler3
strstr
strtol
atol
??2@YAPAXI@Z
??3@YAXPAX@Z
malloc
_stricmp

Exports

Exports

ServiceMain

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ