662983bbfc00093ddfd86225ac613307_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

662983bbfc00093ddfd86225ac613307_JaffaCakes118
Size

5KB
MD5

662983bbfc00093ddfd86225ac613307
SHA1

9ded19093f70c5ae23537cbb935b8e2145788d45
SHA256

05ab19eb238d1373fce738d3ca47c3f3f4310a021aa72664f60851fbef7a1b8d
SHA512

5c7048294f68b61b231830f8c2a1c966819748034b771077d6398422527409d68fdc93bb575cc9c1824c7c09179031c649d7d56738d7a012c1b7ce017ef3d971
SSDEEP

96:mbBne+g4y/AHl+lrrcgDrcyjpqSFofXVAtw:UVeNRrxDrFpqSF2VK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
662983bbfc00093ddfd86225ac613307_JaffaCakes118

Files

662983bbfc00093ddfd86225ac613307_JaffaCakes118
.dll windows:4 windows x86 arch:x86

b8518a2f82e7d190559d401350d5ef92

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord537
ord800
ord1575
ord1182
ord823
ord1168
ord342
ord1253

msvcrt

_adjust_fdiv
malloc
_initterm
strcat
sprintf
free

kernel32

FreeConsole
Sleep
CreateProcessA
GetTempFileNameA
GetSystemWindowsDirectoryA
OutputDebugStringA
DeleteFileA
GetModuleHandleA
GetCommandLineA
CreateThread

user32

OpenWindowStationA
CloseWindowStation
SetProcessWindowStation
GetProcessWindowStation

advapi32

SetServiceStatus
RegisterServiceCtrlHandlerExA

urlmon

URLDownloadToFileA

Exports

Exports

ServiceMain

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 1022B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 242B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ