ad79a2ec6a5d5db8a5d1c64d57732461_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ad79a2ec6a5d5db8a5d1c64d57732461_JaffaCakes118
Size

14KB
MD5

ad79a2ec6a5d5db8a5d1c64d57732461
SHA1

d9893ec9bfab03c8910034e951825b64d391416a
SHA256

a1f4025352e82d446bfd6ba091a7bffb1854d4180b3fa59c5c5895df2b88d6f5
SHA512

e55e34254dea05461218dd54430fdaf863033ded0df316fd85953f4ce9dc7decfa8b1dbff5a47a14adf8996e725403dad1ba5d35610e01105aefb44415dee073
SSDEEP

192:TO8bpdIV9GvlfNrhrAzeTwW2bPev/WnmMpONG:TORCpt+zF/LDnmMs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ad79a2ec6a5d5db8a5d1c64d57732461_JaffaCakes118

Files

ad79a2ec6a5d5db8a5d1c64d57732461_JaffaCakes118
.dll windows:4 windows x86 arch:x86

1ab6cfaeac675d387ce586019bb2a781

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileA
ExitProcess
GetLastError
FreeLibrary
GlobalFree
LoadLibraryExA
WriteFile
GetProcAddress
GetModuleHandleA
lstrcatW
GetSystemDirectoryW
LoadLibraryA
DeleteFileA
GetWindowsDirectoryA
Sleep
DeviceIoControl
GetFileAttributesA
CreateToolhelp32Snapshot
Process32First
Process32Next
GlobalAlloc
CloseHandle

advapi32

StartServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
ControlService
DeleteService
CreateServiceA

msvcrt

_strcmpi

Exports

Exports

RSDK

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 440B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ