5ba3a09fdd609957aaafd3be55f94313_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5ba3a09fdd609957aaafd3be55f94313_JaffaCakes118
Size

8KB
MD5

5ba3a09fdd609957aaafd3be55f94313
SHA1

dfc003d051b860ee0bfebe57536b349ba8c75ffb
SHA256

191a7017aeab98b65d61668bca82b19667b48ed30501fd1ae79b64081b96ff8d
SHA512

b0a4cd8749d7fa6baf2353f4c68d7d58229fbea1f52fdcf41c837bd127ee0c5e264b167b9789d40f7421c1e6730987ad3a2d98f40939900f696f444927a423fc
SSDEEP

96:i41AHhN1Sg1iO4tIaBc5bmqu+8oJj/27JccL5ywHwbvW94LV:iYABNIIiJxUmq38Y1WkvW6L

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5ba3a09fdd609957aaafd3be55f94313_JaffaCakes118

Files

5ba3a09fdd609957aaafd3be55f94313_JaffaCakes118
.dll windows:4 windows x86 arch:x86

84a2415e0fec8ac9352e1b97a87a26a5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenA
OpenProcess
FreeLibrary
CloseHandle
VirtualAllocEx
LoadLibraryA
GetSystemDirectoryA
CreateThread
WriteProcessMemory
GetModuleHandleA
GetProcAddress
CreateRemoteThread
Sleep
GetCurrentProcess

advapi32

SetServiceStatus
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegisterServiceCtrlHandlerA

msvcrt

_initterm
malloc
_adjust_fdiv
_stricmp
free

Exports

Exports

ServiceMain

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 829B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 226B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ