b28f7994f9bdea8a5d8990ddef1ad445_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b28f7994f9bdea8a5d8990ddef1ad445_JaffaCakes118
Size

36KB
MD5

b28f7994f9bdea8a5d8990ddef1ad445
SHA1

8e2d50e826dc595eafd7b33b7dbcab71a33f6043
SHA256

38499a5289dcd333cb50eb7aac9886448e7b2d3792516e8ecd938a2279e5ace1
SHA512

df2ebb9540705990db4474efb115f6d38349c4ea7a1973305f606e1bbc80a78a0d76ec15dc8a5e3925164a7ec20c56e7368667592df45a3f5a2d2f1ba3359d90
SSDEEP

384:F6tsTq8WqaQ7fpi/TLGdLwvPOuEwMNxRJXjCUGKujTyBDeyYop6m:MtmPfpi/HGLw3YwGxRJTCspgyc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b28f7994f9bdea8a5d8990ddef1ad445_JaffaCakes118

Files

b28f7994f9bdea8a5d8990ddef1ad445_JaffaCakes118
.dll windows:4 windows x86 arch:x86

1ba2100264a82d48ed1b5092c86138a8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WriteFile
CloseHandle
ReadFile
GetFileSize
CreateFileA
GetTempPathA
Sleep
MultiByteToWideChar
FreeLibrary
lstrcpyA
GetLocalTime
GetStartupInfoA
lstrcatA
FreeConsole
GetLastError
DisableThreadLibraryCalls
LoadLibraryA
lstrlenA
GetProcAddress

user32

wsprintfA

advapi32

RegisterServiceCtrlHandlerA
SetServiceStatus

msvcrt

??3@YAXPAX@Z
strncpy
printf
strstr
atoi
sscanf
rand
isspace
strtok
strncmp
wcstombs
__dllonexit
_onexit
free
_initterm
malloc
_adjust_fdiv
_strnicmp

ws2_32

WSAStartup
gethostname
inet_addr

Exports

Exports

ServiceMain

Sections

.text
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 504KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ