63d890df0359ad2fb27dd687031836d8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

63d890df0359ad2fb27dd687031836d8_JaffaCakes118
Size

52KB
MD5

63d890df0359ad2fb27dd687031836d8
SHA1

9ed3fac8038fcade4fe89baf49b7a2e6d68d0149
SHA256

112debacfe82d987c64ce90942c1bfc83e86059ded2a88b2c3ec1c498c534085
SHA512

0efab5556972e761921c7fdc730d92095cbc821ac4aab4fe8476a3e659a1c38ffb95d5cd98857de270b2b3bb2c05b87fc1ef3d69465aaca40ba35034c56825a5
SSDEEP

768:yUajDbq4zB7A6dfURmZt1FCo07xpX/VZqlh4ZJyDDjFaVhs9WtuX1Gfp7uTsf:yU14zW6d88X1FCh7xpNkL4O7FD4p7ug

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
63d890df0359ad2fb27dd687031836d8_JaffaCakes118

Files

63d890df0359ad2fb27dd687031836d8_JaffaCakes118
.dll windows:4 windows x86 arch:x86

bd227ba966c127e93fe82f25f211eaca

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualFree
VirtualAlloc
GetProcAddress
ExitProcess
LoadLibraryExA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
HeapAlloc
GetProcessHeap
HeapFree

user32

wsprintfA
MessageBoxA

Exports

Exports

ResetSSDT
ServiceMain

Sections

.data
Size: 41KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_rl
Size: 288B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ